What is GHSA-hcc4-c3v8-rx92?

GHSA-hcc4-c3v8-rx92 is a security advisory published by GitHub Security Advisories with Low severity. AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Which CVE IDs does GHSA-hcc4-c3v8-rx92 cover?

GHSA-hcc4-c3v8-rx92 covers the following CVE IDs: CVE-2026-34513. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hcc4-c3v8-rx92?

GHSA-hcc4-c3v8-rx92 affects 1 product, including: pip/aiohttp:\u003c= 3.13.3.

GHSA-hcc4-c3v8-rx92Low

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Vendor

GitHub Security Advisories

Published

April 1, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34513 →

📋 Description

Summary

An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.

Impact

If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.

Patch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98

🎯 Affected products1

pip/aiohttp:<= 3.13.3

🔗 References (5)

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92
https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98
https://nvd.nist.gov/vuln/detail/CVE-2026-34513
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
https://github.com/advisories/GHSA-hcc4-c3v8-rx92