AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

The core of the vulnerability lies in aiohttp's DNS caching mechanism. If an application utilizing aiohttp makes a large number of requests to distinct hostnames, the DNS cache can grow without bounds. This uncontrolled growth consumes increasing amounts of system memory. Eventually, this memory exhaustion can lead to a denial of service, effectively rendering the application unresponsive or crashing the server. The impact is particularly severe in environments where applications frequently resolve new hostnames, such as those interacting with dynamic content delivery networks or large-scale distributed systems. While the CVSS score is LOW, the potential for service disruption warrants prompt remediation.

Applications heavily reliant on aiohttp for making numerous DNS requests are at higher risk. This includes web applications interacting with CDNs, microservice architectures with frequent inter-service communication, and systems performing large-scale data scraping or crawling. Environments using older, unpatched versions of aiohttp are particularly vulnerable.

• python / server:

import psutil

# Monitor memory usage
memory_usage = psutil.virtual_memory().percent
print(f"Memory usage: {memory_usage}%")

• python / server:

# Check aiohttp version
python -c "import aiohttp; print(aiohttp.__version__)"

• generic web:

# Check for excessive DNS requests in access logs (example)
grep 'DNS' /var/log/nginx/access.log | wc -l

1. 2026-04-01Disclosure

   disclosure

2. 2026-04-01Patch

   patch

1. Reservado2026-03-30
2. Publicada2026-04-01
3. Modificada2026-04-06
4. EPSS atualizado2026-04-09

The primary mitigation for CVE-2026-34513 is to upgrade to aiohttp version 3.13.4 or later, which includes a fix for the unbounded DNS cache. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing temporary workarounds. One approach is to limit the number of concurrent DNS requests made by the application. Another is to manually manage the DNS cache, periodically clearing or pruning entries to prevent excessive growth. Monitor memory usage closely after any changes. The official patch details the fix: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98. After upgrading, verify the fix by simulating a scenario that would trigger the unbounded cache growth and confirming that memory usage remains within acceptable limits.