Aiosend
Monthly
Deserialization-before-authentication in aiosend's WebhookHandler exposes all webhook integrations prior to version 3.0.7 to pre-authentication denial-of-service. An unauthenticated remote attacker can submit arbitrarily large or complex JSON payloads to any reachable aiosend webhook endpoint, forcing a full Pydantic model deserialization pass - including retention of attacker-supplied extra fields in memory due to CryptoPayObject's extra='allow' configuration - before the HMAC signature is checked and the request is rejected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no credentials and minimal skill.
Deserialization-before-authentication in aiosend's WebhookHandler exposes all webhook integrations prior to version 3.0.7 to pre-authentication denial-of-service. An unauthenticated remote attacker can submit arbitrarily large or complex JSON payloads to any reachable aiosend webhook endpoint, forcing a full Pydantic model deserialization pass - including retention of attacker-supplied extra fields in memory due to CryptoPayObject's extra='allow' configuration - before the HMAC signature is checked and the request is rejected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no credentials and minimal skill.