The vulnerability arises from aiosend's webhook handler deserializing JSON request bodies before verifying their HMAC signature, allowing an unauthenticated attacker to send large, complex JSON payloads that consume excessive CPU and memory before being rejected. This uncontrolled resource consumption can degrade system performance and cause denial of service. The weakness is classified as CWE‑400, representing an uncontrolled resource consumption flaw.

All versions of vovchic17's aiosend older than 3.0.7 are affected, including the 3.0.6 and earlier releases. The issue was fixed in v3.0.7, so upgrading to that or later versions removes the vulnerability. Systems exposing the webhook endpoint to untrusted clients are at risk.

The CVSS score of 7.5 reflects a high risk level, and the lack of an EPSS score does not diminish the potential for exploitation by attackers who can target the exposed webhook. As the flaw permits unauthenticated requests to trigger resource exhaustion, the attack vector is network-based, leveraging standard HTTP traffic to submit oversized JSON payloads. The vulnerability is not listed in the CISA KEV catalog, but the severity and potential impact warrant immediate attention.