CVE-2024-52303

What it actually does

Memory leak triggered when requests produce MatchInfoError, because each error builds a unique cache entry that is never reused or cleared.

Why it matters to the business

Attackers can exhaust server memory with hundreds of thousands to millions of crafted requests, causing service outages or requiring restarts; the issue affects any deployment using middlewares with aiohttp.web.

How an attack unfolds

An attacker repeatedly sends requests designed to trigger MatchInfoError responses; each request adds a distinct entry to the internal cache, gradually consuming available memory until the server becomes unresponsive.

How to fix it

Upgrade aiohttp to version 3.10.11 or later; organizations using flashplugin-nonfree on Ubuntu 14.04 LTS should apply the listed fixed package version 11.2.202.554ubuntu0.14.04.1.

How to confirm the fix worked

Confirm aiohttp version is at least 3.10.11; run load tests that deliberately trigger MatchInfoError and verify memory usage remains stable instead of growing without bound.

Typical attack path

1. Identify an aiohttp.web endpoint protected by middleware
2. Craft requests that consistently produce MatchInfoError
3. Send a high volume of such requests (hundreds of thousands to millions)
4. Monitor memory consumption until the process is exhausted or crashes

How to detect it

Review application and access logs for unusually high volumes of requests that result in 404 or similar error responses; correlate with memory-growth metrics on aiohttp worker processes.

What your security team should do

• Prioritize upgrade of all aiohttp installations to 3.10.11 within the next maintenance window
• Add memory-usage monitoring and alerting for aiohttp processes
• Review middleware configurations to reduce unnecessary MatchInfoError paths where possible