High, CVSS 7.5PyPIAmendedPublished
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
CVE-2026-70646 · GHSA-7m8f-hgjq-8gc9
- Affected
- PyPI aiosend < 3.0.7
- Fixed in
- 3.0.7· Vendor fix available
- Issue
- WebhookHandler.feedupdate() deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Severity High (CVSS 7.5) Affected Package - Ecosystem: PyPI - Package: aiosend Affected Versions - < 3.0.6 Patched Versions - = 3.0.6 Details In aiosend/webhook/base.py, WebhookHandler.feedupdate() performs full Pydantic deserialization before validating the webhook signature: Because authentication occurs only after parsing, anyone can send arbitrarily large JSON payloads with an invalid signature. Although the request is rejected, the server still performs all parsing work. Additionally, CryptoPayObject is configured with: allowing arbitrary extra fields to be retained in memory, increasing resource consumption. Impact An unauthenticated attacker can repeatedly send large invalid webhook requests,…
Recommended action: Upgrade to 3.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.