Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | No fix yet | — |
| Debian 13 | python-aiohttp | No fix yet | — |
| Debian 12 | python-aiohttp | No fix yet | — |
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9
- https://github.com/aio-libs/aiohttp/pull/13362
- https://github.com/aio-libs/aiohttp/pull/13391
- https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85
- https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4