EUVD-2026-18035
GHSA-hcc4-c3v8-rx92
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 122 pypi packages depend on aiohttp (43 direct, 79 indirect)
Ecosystem-wide dependent count for version 3.13.4.
DescriptionGitHub Advisory
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
AnalysisAI
Unbounded DNS cache in AIOHTTP prior to version 3.13.4 allows remote attackers to cause denial of service through excessive memory consumption. An attacker can trigger repeated DNS lookups with unique hostnames to grow the in-memory cache without bounds, eventually exhausting available system memory. AIOHTTP 3.13.4 and later include a patch that implements cache limits. This is a network-accessible vulnerability requiring no authentication or user interaction, but exploitation requires deliberate attack traffic and does not result in data compromise or system takeover.
Technical ContextAI
AIOHTTP is a Python asynchronous HTTP client and server framework built on asyncio. The vulnerability exists in the DNS caching mechanism that stores resolved hostnames and their corresponding IP addresses to improve performance. The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) stems from the absence of size or eviction policy controls on the DNS cache data structure. When an attacker sends HTTP requests to a large number of unique or crafted hostnames, each lookup result is stored in the cache indefinitely. Over time, especially in high-traffic or under sustained attack, this unbounded cache grows without bound, consuming heap memory and potentially triggering out-of-memory conditions. The flaw affects all versions of AIOHTTP prior to 3.13.4 where this resource constraint was not implemented.
RemediationAI
Vendor-released patch: AIOHTTP 3.13.4 or later. Users should upgrade to version 3.13.4 or any subsequent release immediately. The patch implements bounded DNS cache with appropriate eviction and size limits. For deployments unable to upgrade immediately, implement upstream network controls such as request rate-limiting, per-client connection limits, or DNS query throttling at the application or proxy layer. Detailed remediation guidance is available in the GitHub security advisory at https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92 and the upstream fix commit at https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today