Vulnerability-Lookup

PYSEC-2026-3626

Vulnerability from pysec - Published: 2026-08-10 10:43 - Updated: 2026-08-10 11:01

Details

Summary

WebhookHandler.feed_update() deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption.

Severity

High (CVSS 7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Package

Ecosystem: PyPI
Package: aiosend

Affected Versions

< 3.0.6

Patched Versions

>= 3.0.6

Details

In aiosend/webhook/base.py, WebhookHandler.feed_update() performs full Pydantic deserialization before validating the webhook signature:

update = Update.model_validate(body, context={"client": self})
if not self._check_signature(body, headers):
    return False

Because authentication occurs only after parsing, anyone can send arbitrarily large JSON payloads with an invalid signature. Although the request is rejected, the server still performs all parsing work.

Additionally, CryptoPayObject is configured with:

ConfigDict(extra="allow")

allowing arbitrary extra fields to be retained in memory, increasing resource consumption.

Impact

An unauthenticated attacker can repeatedly send large invalid webhook requests, forcing the server to consume CPU time and memory before rejecting them.

This results in a pre-authentication denial-of-service condition affecting all webhook integrations.

Affected Components

aiosend/webhook/base.py
aiosend/types/base.py
AiohttpManager
FastAPIManager
FlaskManager

Workarounds

Until upgrading:

Restrict request body size at the reverse proxy or web framework.
Rate-limit webhook endpoints.
Reject oversized requests before JSON parsing.

Solution

Upgrade to aiosend 3.0.6 or later.

CWE

CWE-400: Uncontrolled Resource Consumption

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impacted products

Name	purl
aiosend	pkg:pypi/aiosend

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiosend",
        "purl": "pkg:pypi/aiosend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.14",
        "0.1.15",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.4",
        "3.0.5",
        "3.0.6"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70646",
    "GHSA-7m8f-hgjq-8gc9"
  ],
  "details": "## Summary\n\n`WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption.\n\n## Severity\n\n**High** (CVSS 7.5)\n\n```\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n```\n\n## Affected Package\n\n- Ecosystem: PyPI\n- Package: `aiosend`\n\n## Affected Versions\n\n- `\u003c 3.0.6`\n\n## Patched Versions\n\n- `\u003e= 3.0.6`\n\n## Details\n\nIn `aiosend/webhook/base.py`, `WebhookHandler.feed_update()` performs full Pydantic deserialization before validating the webhook signature:\n\n```python\nupdate = Update.model_validate(body, context={\"client\": self})\nif not self._check_signature(body, headers):\n    return False\n```\n\nBecause authentication occurs only after parsing, anyone can send arbitrarily large JSON payloads with an invalid signature. Although the request is rejected, the server still performs all parsing work.\n\nAdditionally, `CryptoPayObject` is configured with:\n\n```python\nConfigDict(extra=\"allow\")\n```\n\nallowing arbitrary extra fields to be retained in memory, increasing resource consumption.\n\n## Impact\n\nAn unauthenticated attacker can repeatedly send large invalid webhook requests, forcing the server to consume CPU time and memory before rejecting them.\n\nThis results in a pre-authentication denial-of-service condition affecting all webhook integrations.\n\n## Affected Components\n\n- `aiosend/webhook/base.py`\n- `aiosend/types/base.py`\n- `AiohttpManager`\n- `FastAPIManager`\n- `FlaskManager`\n\n## Workarounds\n\nUntil upgrading:\n\n- Restrict request body size at the reverse proxy or web framework.\n- Rate-limit webhook endpoints.\n- Reject oversized requests before JSON parsing.\n\n## Solution\n\nUpgrade to **aiosend 3.0.6** or later.\n\n## CWE\n\n- CWE-400: Uncontrolled Resource Consumption",
  "id": "PYSEC-2026-3626",
  "modified": "2026-08-10T11:01:33.207387Z",
  "published": "2026-08-10T10:43:48.956879Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vovchic17/aiosend"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/releases/tag/v3.0.7"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/aiosend"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7m8f-hgjq-8gc9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70646"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler"
}

CVE-2026-70646 (GCVE-0-2026-70646)

Vulnerability from cvelistv5 – Published: 2026-08-06 14:38 – Updated: 2026-08-08 02:03

Title

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

Summary

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vovchic17/aiosend/security/adv…	x_refsource_CONFIRM
https://github.com/vovchic17/aiosend/commit/db20f…	x_refsource_MISC
https://github.com/vovchic17/aiosend/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vovchic17	aiosend	Affected: < 3.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-70646",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-08T02:03:28.996737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-08T02:03:41.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiosend",
          "vendor": "vovchic17",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T14:38:52.556Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9"
        },
        {
          "name": "https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4"
        },
        {
          "name": "https://github.com/vovchic17/aiosend/releases/tag/v3.0.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vovchic17/aiosend/releases/tag/v3.0.7"
        }
      ],
      "source": {
        "advisory": "GHSA-7m8f-hgjq-8gc9",
        "discovery": "UNKNOWN"
      },
      "title": "aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-70646",
    "datePublished": "2026-08-06T14:38:52.556Z",
    "dateReserved": "2026-08-04T21:48:08.612Z",
    "dateUpdated": "2026-08-08T02:03:41.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-7M8F-HGJQ-8GC9

Vulnerability from github – Published: 2026-05-22 17:27 – Updated: 2026-08-06 14:38

Summary

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

Details

Summary

Severity

High (CVSS 7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Package

Ecosystem: PyPI
Package: aiosend

Affected Versions

< 3.0.6

Patched Versions

>= 3.0.6

Details

In aiosend/webhook/base.py, WebhookHandler.feed_update() performs full Pydantic deserialization before validating the webhook signature:

update = Update.model_validate(body, context={"client": self})
if not self._check_signature(body, headers):
    return False

Additionally, CryptoPayObject is configured with:

ConfigDict(extra="allow")

allowing arbitrary extra fields to be retained in memory, increasing resource consumption.

Impact

An unauthenticated attacker can repeatedly send large invalid webhook requests, forcing the server to consume CPU time and memory before rejecting them.

This results in a pre-authentication denial-of-service condition affecting all webhook integrations.

Affected Components

aiosend/webhook/base.py
aiosend/types/base.py
AiohttpManager
FastAPIManager
FlaskManager

Workarounds

Until upgrading:

Restrict request body size at the reverse proxy or web framework.
Rate-limit webhook endpoints.
Reject oversized requests before JSON parsing.

Solution

Upgrade to aiosend 3.0.6 or later.

CWE

CWE-400: Uncontrolled Resource Consumption

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiosend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70646"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-22T17:27:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption.\n\n## Severity\n\n**High** (CVSS 7.5)\n\n```\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n```\n\n## Affected Package\n\n- Ecosystem: PyPI\n- Package: `aiosend`\n\n## Affected Versions\n\n- `\u003c 3.0.6`\n\n## Patched Versions\n\n- `\u003e= 3.0.6`\n\n## Details\n\nIn `aiosend/webhook/base.py`, `WebhookHandler.feed_update()` performs full Pydantic deserialization before validating the webhook signature:\n\n```python\nupdate = Update.model_validate(body, context={\"client\": self})\nif not self._check_signature(body, headers):\n    return False\n```\n\nBecause authentication occurs only after parsing, anyone can send arbitrarily large JSON payloads with an invalid signature. Although the request is rejected, the server still performs all parsing work.\n\nAdditionally, `CryptoPayObject` is configured with:\n\n```python\nConfigDict(extra=\"allow\")\n```\n\nallowing arbitrary extra fields to be retained in memory, increasing resource consumption.\n\n## Impact\n\nAn unauthenticated attacker can repeatedly send large invalid webhook requests, forcing the server to consume CPU time and memory before rejecting them.\n\nThis results in a pre-authentication denial-of-service condition affecting all webhook integrations.\n\n## Affected Components\n\n- `aiosend/webhook/base.py`\n- `aiosend/types/base.py`\n- `AiohttpManager`\n- `FastAPIManager`\n- `FlaskManager`\n\n## Workarounds\n\nUntil upgrading:\n\n- Restrict request body size at the reverse proxy or web framework.\n- Rate-limit webhook endpoints.\n- Reject oversized requests before JSON parsing.\n\n## Solution\n\nUpgrade to **aiosend 3.0.6** or later.\n\n## CWE\n\n- CWE-400: Uncontrolled Resource Consumption",
  "id": "GHSA-7m8f-hgjq-8gc9",
  "modified": "2026-08-06T14:38:20Z",
  "published": "2026-05-22T17:27:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vovchic17/aiosend"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vovchic17/aiosend/releases/tag/v3.0.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

PYSEC-2026-3626

Summary

Severity

Affected Package

Affected Versions

Patched Versions

Details

Impact

Affected Components

Workarounds

Solution

CWE

CVE-2026-70646 (GCVE-0-2026-70646)

GHSA-7M8F-HGJQ-8GC9

Summary

Severity

Affected Package

Affected Versions

Patched Versions

Details

Impact

Affected Components

Workarounds

Solution

CWE

Tags

Sightings

Nomenclature