CVE-2024-52303: Aiohttp Memory Leak DoS Vulnerability

CVE-2024-52303 Overview

CVE-2024-52303 is a memory leak vulnerability in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. The flaw affects versions starting with 3.10.6 and prior to 3.10.11. Each request that produces a MatchInfoError adds a unique entry to an internal cache, causing unbounded memory growth. An attacker can exhaust server memory resources by sending hundreds of thousands to millions of crafted requests. The vulnerability is tracked under [CWE-772: Missing Release of Resource after Effective Lifetime].

Critical Impact
Remote, unauthenticated attackers can exhaust server memory and trigger a denial-of-service condition against any aiohttp.web application using middlewares.

Affected Products

aiohttp versions 3.10.6 through 3.10.10
aiohttp.web applications using any middleware
Python services built on aiohttp framework with system route handling

Discovery Timeline

2024-11-18 - CVE-2024-52303 published to NVD
2025-08-15 - Last updated in NVD database

Technical Details for CVE-2024-52303

Vulnerability Analysis

The vulnerability stems from improper cache management within aiohttp's URL dispatcher. When an incoming request matches a system route in a way that triggers a MatchInfoError, aiohttp constructs a new error object and stores it in an internal middleware cache. Each MatchInfoError instance produces a unique cache key, so the cache never deduplicates entries for repeated failure conditions.

Over time, the cache grows linearly with the number of error-producing requests. A sustained flood of such requests forces the Python process to allocate memory until the operating system kills it or the host becomes unresponsive. The flaw resides in aiohttp/web_app.py, where SystemRoute instances pollute the middleware cache.

Root Cause

The root cause is missing resource release [CWE-772] in aiohttp's middleware caching logic. The framework treats every MatchInfoError as distinct, so the cache lacks a bounded size and lacks logic to exclude system routes from caching. Repeated invocation results in unbounded heap growth.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a substantial volume of HTTP requests (100,000s to millions) that trigger MatchInfoError, such as requests to non-existent paths handled by the system route. The cache grows with each request until memory is exhausted.

python

# Patch reference from aiohttp/web_app.py
     MaskDomain,
     MatchedSubAppResource,
     PrefixedSubAppResource,
+    SystemRoute,
     UrlDispatcher,
 )
# Source: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
# The patch imports SystemRoute so it can be excluded from middleware caching, preventing the cache from being polluted by error-producing requests.

Detection Methods for CVE-2024-52303

Indicators of Compromise

Sustained increase in resident memory of the Python aiohttp worker process without a corresponding rise in legitimate traffic
High volume of HTTP 404 or routing-error responses originating from a small set of source IPs
Application logs showing repeated MatchInfoError events from the URL dispatcher
Out-of-memory (OOM) kills of aiohttp processes in container or systemd logs

Detection Strategies

Monitor process-level memory metrics (RSS) for aiohttp services and alert on monotonic growth patterns
Correlate request-rate spikes against routes that consistently produce 404 or error responses
Inspect aiohttp dependency versions in production deployments and flag versions in the 3.10.6 to 3.10.10 range

Monitoring Recommendations

Track HTTP error-rate ratios per source IP and rate-limit clients that exceed configured thresholds
Enable application performance monitoring (APM) with heap-size sampling for Python services
Forward aiohttp access logs to a centralized logging platform and create queries for repeated routing failures

How to Mitigate CVE-2024-52303

Immediate Actions Required

Upgrade aiohttp to version 3.10.11 or later in all production and staging environments
Audit all Python services to identify any deployments using aiohttp.web with middlewares
Place a reverse proxy or web application firewall in front of aiohttp services to enforce rate limiting on error-producing requests
Configure process memory limits (e.g., cgroups, container limits) to contain impact if exploitation occurs

Patch Information

The aiohttp maintainers released a fix in version 3.10.11. The patch, available in commit bc15db6, excludes SystemRoute instances from the middleware cache to prevent cache pollution from error-producing requests. Full details are published in the GitHub Security Advisory GHSA-27mf-ghqm-j3j8.

Workarounds

Remove middleware usage from aiohttp.web applications if upgrading is not immediately possible, since the cache is only populated when middlewares are present
Deploy upstream rate limiting at a load balancer or WAF to restrict the volume of error-producing requests per source
Restart aiohttp worker processes on a scheduled cadence to reclaim leaked memory as a temporary measure

bash

# Upgrade aiohttp to the patched release
pip install --upgrade 'aiohttp>=3.10.11'

# Verify installed version
python -c "import aiohttp; print(aiohttp.__version__)"