CVE-2026-70646

{
  "id": "CVE-2026-70646",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T15:17:27.750",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing."
    },
    {
      "lang": "es",
      "value": "aiosend es un cliente API de Crypto Pay síncrono y asíncrono. Antes de la versión 3.0.7, ’WebhookHandler.feed_update()’ deserializa todo el cuerpo de la solicitud antes de verificar la firma HMAC. Esto permite a un atacante no autenticado forzar un análisis costoso de cargas útiles JSON arbitrarias que finalmente serán rechazadas, lo que lleva a un consumo innecesario de CPU y memoria. La versión 3.0.7 soluciona el problema. Algunas soluciones alternativas están disponibles. Restrinja el tamaño del cuerpo de la solicitud en el proxy inverso o framework web, limite la tasa de los puntos finales de webhook y/o rechace las solicitudes de tamaño excesivo antes del análisis JSON."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "vovchic17",
          "product": "aiosend",
          "versions": [
            {
              "version": "< 3.0.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-08T02:03:28.996737Z",
          "id": "CVE-2026-70646",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/vovchic17/aiosend/releases/tag/v3.0.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9",
      "source": "[email protected]"
    }
  ]
}