id: PYSEC-2026-3626
published: "2026-08-10T10:43:48.956879Z"
modified: "2026-08-10T11:01:33.207387Z"
aliases:
- CVE-2026-70646
- GHSA-7m8f-hgjq-8gc9
summary: "aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler"
details: "## Summary\n\n`WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption.\n\n## Severity\n\n**High** (CVSS 7.5)\n\n```\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n```\n\n## Affected Package\n\n- Ecosystem: PyPI\n- Package: `aiosend`\n\n## Affected Versions\n\n- `< 3.0.6`\n\n## Patched Versions\n\n- `>= 3.0.6`\n\n## Details\n\nIn `aiosend/webhook/base.py`, `WebhookHandler.feed_update()` performs full Pydantic deserialization before validating the webhook signature:\n\n```python\nupdate = Update.model_validate(body, context={\"client\": self})\nif not self._check_signature(body, headers):\n    return False\n```\n\nBecause authentication occurs only after parsing, anyone can send arbitrarily large JSON payloads with an invalid signature. Although the request is rejected, the server still performs all parsing work.\n\nAdditionally, `CryptoPayObject` is configured with:\n\n```python\nConfigDict(extra=\"allow\")\n```\n\nallowing arbitrary extra fields to be retained in memory, increasing resource consumption.\n\n## Impact\n\nAn unauthenticated attacker can repeatedly send large invalid webhook requests, forcing the server to consume CPU time and memory before rejecting them.\n\nThis results in a pre-authentication denial-of-service condition affecting all webhook integrations.\n\n## Affected Components\n\n- `aiosend/webhook/base.py`\n- `aiosend/types/base.py`\n- `AiohttpManager`\n- `FastAPIManager`\n- `FlaskManager`\n\n## Workarounds\n\nUntil upgrading:\n\n- Restrict request body size at the reverse proxy or web framework.\n- Rate-limit webhook endpoints.\n- Reject oversized requests before JSON parsing.\n\n## Solution\n\nUpgrade to **aiosend 3.0.6** or later.\n\n## CWE\n\n- CWE-400: Uncontrolled Resource Consumption"
affected:
- package:
    name: aiosend
    ecosystem: PyPI
    purl: pkg:pypi/aiosend
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.0.7
  versions:
  - 0.1.14
  - 0.1.15
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.0.4
  - 3.0.5
  - 3.0.6
references:
- type: WEB
  url: https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9
- type: WEB
  url: https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4
- type: PACKAGE
  url: https://github.com/vovchic17/aiosend
- type: WEB
  url: https://github.com/vovchic17/aiosend/releases/tag/v3.0.7
- type: PACKAGE
  url: https://pypi.org/project/aiosend
- type: ADVISORY
  url: https://github.com/advisories/GHSA-7m8f-hgjq-8gc9
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-70646
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H