PyPI/aiosend CVE-2026-70646: high 7.5, EPSS 0.64%
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
Action: Upgrade aiosend to 3.0.7 or later.
pip install aiosend==3.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.7 | - |
Fixed versions
| 3.0.7 |
Sources
- osv: PYSEC-2026-3626
- https://github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9
- https://github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4
- https://github.com/vovchic17/aiosend
- https://github.com/vovchic17/aiosend/releases/tag/v3.0.7
- https://pypi.org/project/aiosend
- https://github.com/advisories/GHSA-7m8f-hgjq-8gc9
- https://nvd.nist.gov/vuln/detail/CVE-2026-70646
CVE-2026-70646 · published · modified · JSON