Skip to content
Fencer Intel
medium 5.5

CVE-2022-33124 json

Withdrawn: Denial of Service in aiohttp

published 4y ago modified 4mo ago also GHSA-rwqr-c348-m5wr , PYSEC-2022-43059 , EUVD-2022-0002

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application

Is CVE-2022-33124 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-33124 updated cvss 0.0

python-aiohttp: invalid IPv6 URL which can lead to a Denial of Service with exception raised

  • Red Hat Ansible Automation Platform 1.2 aiohttp, python-aiohttp Red Hat Ansible Automation Platform 2 python-aiohttp Red Hat Ansible Tower 3 aiohttp Red Hat Satellite 6 python-aiohttp, python3-aiohttp Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/aio-libs/aiohttp/issues/6772 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.