Technical impact
The AIOHTTP framework processes HTTP/1 pipelined requests without setting an upper bound. When a client sends many pipelined requests in a single TCP connection, the server queues them indefinitely. Each queued request consumes memory for the request buffer, parsing state, and response preparation. An attacker who repeatedly issues pipelined requests can cause the server process to consume excessive memory, eventually crashing or becoming unresponsive. This flaw is a classical resource exhaustion problem, identified as CWE‑770. The primary consequence is denial of service; no direct impact on confidentiality or integrity is described.
Affected Systems
All versions of AIOHTTP prior to 3.14.1 are vulnerable. This includes every pipelined HTTP/1 implementation distributed by aio-libs. Deployments using AIOHTTP 3.x up through 3.13.xx, or any 3.13.x series, are affected. The vulnerability has been patched in release 3.14.1 and later.
Risk and Exploitability
The CVSS base score of 6.6 indicates a moderate severity. EPSS is not available, so the current estimated exploitation probability cannot be quantified. The flaw is listed as not in CISA KEV. The attack likely requires network access to the AIOHTTP server and the ability to send a large number of pipelined HTTP/1 requests. No authentication or privilege is required, so any external actor can exploit the issue. Given the lack of mitigation in older releases, the risk remains significant until a patch is applied.
Github GHSA