Withdrawn: Denial of Service in aiohttp

published 2022-06-22 4 y ago modified 2026-06-17 4 mo ago also GHSA-rwqr-c348-m5wr , PYSEC-2022-43059 , EUVD-2022-0002

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits: 0; none known

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-33124 updated 2025-11-21 cvss 0.0

python-aiohttp: invalid IPv6 URL which can lead to a Denial of Service with exception raised

Red Hat Ansible Automation Platform 1.2 aiohttp, python-aiohttp Red Hat Ansible Automation Platform 2 python-aiohttp Red Hat Ansible Tower 3 aiohttp Red Hat Satellite 6 python-aiohttp, python3-aiohttp Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/aio-libs/aiohttp/issues/6772 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

References

github.com /aio-libs/aiohttp/issues/6772
web, exploit, issue-tracking, third-party-advisory, evidence, report
nvd.nist.gov /vuln/detail/CVE-2022-33124
advisory
github.com /aio-libs/aiohttp
package
github.com /pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2022-43059.yaml
web
github.com /advisories/GHSA-rwqr-c348-m5wr
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary