Description

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T15:17:27.750Z",
  "pubdate": "2026-08-06T15:17:27.750Z",
  "executiveSummary": "A Denial of Service vulnerability exists in the aiosend Crypto Pay API client prior to version 3.0.7, specifically within the WebhookHandler.feed_update() function.\nThe flaw allows unauthenticated remote attackers to cause excessive CPU and memory consumption by supplying arbitrary, large JSON payloads.\nThe vulnerability stems from the application deserializing the entire incoming request body before validating the cryptographic HMAC signature.\nBecause signature verification occurs after the parsing phase, malicious actors can flood the webhook endpoint with computationally expensive payloads that are ultimately rejected.\nThis leads to resource exhaustion and potential service unavailability for legitimate clients relying on the affected system.\nNo special privileges or authentication are required to trigger this behavior, as the attack vector targets publicly exposed webhook endpoints designed to ingest external HTTP requests.\nImmediate remediation requires upgrading to version 3.0.7 or implementing strict request body size limits and payload validation at the reverse proxy or web framework layer.",
  "technicalDetails": "The vulnerability resides in the WebhookHandler.feed_update() component of aiosend in versions prior to 3.0.7.\nThe core root cause of this security issue is an improper ordering of security checks and data processing steps during webhook ingestion.\nSpecifically, the application processes and deserializes the entire raw HTTP request body into internal data structures prior to performing cryptographic verification of the accompanying HMAC signature.\nIn a secure implementation, integrity and authenticity validation via HMAC must be executed against the raw byte stream before any complex parsing logic is initiated.\nThe attack flow begins when an unauthenticated remote attacker sends a specially crafted, oversized, or deeply nested JSON payload to the network-exposed webhook endpoint.\nUpon receiving the request, WebhookHandler.feed_update() immediately invokes the JSON parsing routines to decode the payload into memory.\nThis forces the underlying runtime environment to allocate significant memory and expend high CPU cycles parsing the arbitrary JSON structure.\nOnly after the parsing overhead is fully incurred does the application compute and verify the HMAC signature, at which point the request is recognized as invalid and dropped.\nBecause the computationally expensive deserialization occurs prior to authentication verification, an attacker can leverage this asymmetric computational load to execute a Denial of Service attack.\nRepeated submission of malicious payloads exhausts host resources, degrading performance or causing crashes across affected systems running aiosend versions prior to 3.0.7."
}