AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

The core of the vulnerability lies in aiohttp's DNS caching mechanism. If an application using aiohttp makes a large number of requests to distinct hostnames, the DNS cache can grow without bounds. This uncontrolled growth consumes increasing amounts of memory. Eventually, this can exhaust available system resources, leading to a denial of service. The impact is primarily resource exhaustion, potentially rendering the application unresponsive and impacting dependent services. While the CVSS score is LOW, the potential for disruption in high-traffic environments should not be underestimated.

Applications heavily reliant on aiohttp for making numerous DNS requests are at higher risk. This includes web applications interacting with CDNs, microservice architectures with frequent inter-service communication, and systems performing large-scale data scraping or crawling. Environments using older, unpatched versions of aiohttp are particularly vulnerable.

• python / server:

import psutil

# Monitor memory usage
memory_usage = psutil.virtual_memory().percent
print(f"Memory usage: {memory_usage}%")

• python / server:

# Check aiohttp version
python -c "import aiohttp; print(aiohttp.__version__)"

• generic web:

# Check for excessive DNS requests in access logs (example)
grep 'DNS' /var/log/nginx/access.log | wc -l

1. 2026-04-01Disclosure

   disclosure

2. 2026-04-01Patch

   patch

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-34513 is to upgrade to aiohttp version 3.13.4 or later, which includes a fix for the unbounded DNS cache. If an immediate upgrade is not feasible, consider implementing rate limiting on DNS requests to prevent excessive cache growth. Additionally, monitoring system memory usage is crucial to detect potential DoS conditions. While a WAF is unlikely to directly mitigate this, it can help detect and block suspicious patterns of DNS requests. The official patch details the fix: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98. After upgrading, verify the fix by simulating a high volume of DNS requests and confirming that memory usage remains within acceptable limits.