Inefficient regular expression complexity in aiohttp - #VU162574
Published: November 9, 2026
Vulnerability identifier: #VU162574
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to stall an aiohttp server's event loop and deny service to clients.
The vulnerability exists due to inefficient regular expression matching in Application.add_domain() when a registered domain mask contains two or more wildcards. An unauthenticated remote attacker can send requests with a long, nonmatching Host header to trigger polynomial-time processing and block the event loop.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4