[Security] Dependabot: aiohttp (HIGH) - aiohttp: Multiple instances of excessive or unbounded memory/CPU use #414

Security Vulnerability Details

• Type: Dependabot Alert docs: update OpenWiki #396
• Package: aiohttp
• Severity: HIGH
• Vulnerable Versions: <= 3.14.3
• Patched Version: 3.14.4
• Advisory IDs: GHSA-2g87-pp6c-29x5 / N/A
• Alert URL: https://github.com/lgcorzo/mlops-python-package/security/dependabot/396

Summary

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Description

Summary

Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.

Impact

An attacker could cause resource exhaustion through specially crafted requests.

Remediation Steps

1. Upgrade aiohttp to version 3.14.4 or higher in project dependency specifications.
2. Run test suites and lockfile generation to ensure backwards compatibility.
3. Commit and deploy patched dependencies.

#jules