Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | >= 3.10.6, < 3.10.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | 3.10.11-1 | — |
| Debian 13 | python-aiohttp | 3.10.11-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-aiohttp | 3.11.9-1.1 | openSUSE-SU-2024:14556-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow | 2.10.3-r2 | — |
| Wolfi rolling | checkov | 3.2.432-r0 | — |
| Wolfi rolling | py3-aiohttp | 3.10.11-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | aiohttp | >= 3.10.6, < 3.10.11 | 3.10.11 | GHSA-27mf-ghqm-j3j8 |
Advisories 3
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2024:14556-1 python310-aiohttp-3.11.9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025