CVE-2026-70646

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70646
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70646.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70646
Aliases
Published
2026-08-06T14:38:52.556Z
Modified
2026-08-09T03:30:30.306383695Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
Details

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feed_update() deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70646.json"
}
References

Affected packages

Git / github.com/vovchic17/aiosend

Affected ranges

Type
GIT
Repo
https://github.com/vovchic17/aiosend
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
db20f0a742209dfac181863d398ec5112687efa4
Fixed
2a6d4b313825f25f3af69ebf993557f442f5d6da
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
v0.*
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70646.json"