Bzt: aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVE-2024-52303)

CVE-2024-52303 describes a memory leak in aiohttp's web framework when middleware is enabled and a request results in a MatchInfoError. The leak is caused by the creation of unique cache entries for each MatchInfoError instance, leading to continuous memory consumption. This vulnerability allows an attacker to exhaust server memory by sending a high volume of requests with disallowed HTTP methods. The issue affects versions >=1.16.35 and <1.16.35_1 of the bzt product. A patch fixing this leak has been released and is available in the aiohttp GitHub repository.

The vulnerability can cause denial of service by exhausting the server's memory resources, impacting availability. There is no confidentiality or integrity impact reported. Exploitation requires sending a large number of requests that trigger MatchInfoError, which can be done without authentication or user interaction.

An official patch is available and should be applied immediately to affected versions. Users of aiohttp with middleware enabled are advised to upgrade to the fixed version to prevent memory exhaustion attacks. No additional mitigations are specified by the vendor.