CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
An attacker can cause a denial of service in aiohttp servers by sending a malformed multipart POST request, leading to an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-30251?
CVE-2024-30251 is a high-severity denial of service vulnerability in aio-libs aiohttp, published on 2 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Weakness: CWE-835
Which versions are affected by CVE-2024-30251?
3 open source packages ship an affected version, including aiohttp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.9.4 |
aiohttp PyPI | All versions | 3.9.4 |
aiohttp PyPI | All versions | 3.9.4 |
Linux distribution packages (15)
python-aiohttp SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp openSUSE:Leap 15.5 | All versions | 3.6.0-150100.3.21.1 |
python-aiohttp openSUSE:Leap 15.5 | All versions | 3.9.3-150400.10.30.1 |
python-aiohttp openSUSE:Leap 15.6 | All versions | 3.9.3-150400.10.30.1 |
Products include Aiohttp Aiohttp.
How do I fix CVE-2024-30251?
Upgrade aiohttp to 3.9.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-30251 being exploited?
There is no known exploitation of CVE-2024-30251 in the wild and no public exploit code.
Other vulnerabilities in aio-libs aiohttp
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
- CVE-2026-54273 AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
Sources
Also known as AZL-43365, AZL-43369, CLSA-2026-1770163992, CLSA-2026-1770250386, DEBIAN-CVE-2024-30251, ECHO-54a8-a5ae-6e95 and 6 more.