CVE-2026-69244
2026-08-03
21h16 +00:00
21h16 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| Out-of-bounds Read The product reads data past the end, or before the beginning, of the intended buffer. |
||
| Uncontrolled Resource Consumption The product does not properly control the allocation and maintenance of a limited resource. |
||
| Use After Free The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
