CVE-2026-70646 Details
Description
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
A denial-of-service vulnerability has been identified in the aiosend package, specifically in versions prior to 3.0.7. The issue arises in the WebhookHandler.feed_update() method, which deserializes the entire request body before verifying the HMAC signature. This flaw allows an unauthenticated attacker to send large JSON payloads that are ultimately rejected, causing unnecessary CPU and memory usage. The vulnerability can be exploited by sending oversized requests to webhook endpoints, forcing the server to parse the data before discarding it.
Users are advised to upgrade to aiosend version 3.0.6 or later. Additionally, it is recommended to restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and reject oversized requests before JSON parsing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4 | [email protected] | Source CodeVendor |
| https://github.com/vovchic17/aiosend/releases/tag/v3.0.7 | [email protected] | Release NotesVendor |
| https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| aiosend | <= 3.0.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |