The vulnerability in aiosend versions before 3.0.7 involves uncontrolled resource consumption (CWE-400) due to the WebhookHandler.feed_update() method deserializing the entire request body prior to HMAC signature verification. This design flaw allows unauthenticated attackers to send arbitrary JSON payloads that are expensive to parse, resulting in unnecessary CPU and memory usage even though the payloads are ultimately rejected. The issue is fixed in version 3.0.7. Mitigations include limiting request body size at the reverse proxy or web framework, rate-limiting webhook endpoints, and rejecting oversized requests before JSON parsing occurs.

An unauthenticated attacker can cause excessive CPU and memory consumption by forcing the server to parse large or complex JSON payloads before verifying authenticity. This can degrade service availability or lead to denial of service conditions. There is no confidentiality or integrity impact reported.

Upgrade to aiosend version 3.0.7 or later where the issue is fixed. Until upgrading, implement workarounds such as restricting the size of request bodies at the reverse proxy or web framework, rate-limiting webhook endpoints, and rejecting oversized requests before JSON parsing to reduce the risk of resource exhaustion.