The vulnerability lies in AIOHTTP’s DNS cache handling; before version 3.13.4 the cache expands unbounded as new DNS queries arrive. This unchecked growth can drain the Python process’s memory, leading to crashes or refusal of new requests, which presents as a denial of service. The weakness is classified as CWE‑770, indicating excessive resource consumption.

All installations of aio-libs AIOHTTP earlier than version 3.13.4 are vulnerable. The issue affects Python developers and system administrators using the library as an asynchronous HTTP client or server framework for asyncio. No additional vendors or products are mentioned.

With a CVSS score of 2.7 the vulnerability is low in severity and expected exploitation difficulty. EPSS data are not released and the issue is not listed in CISA’s KEV catalog, implying limited or no known exploitation in the wild. The likely attack vector is network‑based: an actor can provoke cache overflow by issuing many distinct host queries through the affected AIOHTTP instance. While the vulnerability does not provide arbitrary code execution, the memory exhaustion can degrade service availability and impact dependent applications.