AIOHTTP Multipart Header Size Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in AIOHTTP, an asynchronous HTTP client/server framework for Python. Prior to version 3.13.4, the framework allowed responses with an excessive number of multipart headers to consume more memory than intended. This issue has been addressed in version 3.13.4.

Impact

The vulnerability could lead to excessive memory usage, causing potential denial-of-service conditions. However, other existing restrictions may limit the impact.

Reproduction

The vulnerability can be reproduced by sending a multipart HTTP request with an excessive number of headers, exceeding the typical limits. This can be done using tools or scripts that allow for the manipulation of HTTP headers, such as curl or Postman, or by writing a custom Python script with the requests library. The key is to include enough headers to bypass the normal header size restrictions, which can then be verified by monitoring the memory usage of the application handling the request.

Remediation

Users can upgrade to AIOHTTP version 3.13.4 or later, where this vulnerability has been patched.