The vulnerability in aiosend (CVE-2026-70646) involves uncontrolled resource consumption (CWE-400) due to the WebhookHandler.feed_update() method deserializing the entire JSON request body before HMAC signature verification. This design flaw allows unauthenticated attackers to force the server to perform expensive parsing operations on arbitrary JSON payloads that will ultimately be rejected, resulting in unnecessary CPU and memory consumption. The issue affects versions prior to 3.0.7, which includes all versions less than 3.0.7. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. No known exploits in the wild have been reported. The vendor fixed the issue in version 3.0.7. Workarounds include limiting request body size and rate-limiting webhook endpoints to mitigate resource exhaustion risks.

An unauthenticated attacker can cause excessive CPU and memory consumption on affected systems by sending large or complex JSON payloads to the webhook endpoint. This can lead to denial of service conditions due to resource exhaustion. The vulnerability does not impact confidentiality or integrity but affects availability.

Version 3.0.7 of aiosend fixes this vulnerability. Users should upgrade to version 3.0.7 or later. Until upgrading, mitigations include restricting the request body size at the reverse proxy or web framework level, rate-limiting webhook endpoints, and rejecting oversized requests before JSON parsing to reduce the risk of resource exhaustion.