aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

HIGH 7.5CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5 · PYSEC-2026-2094 · Published 01/04/2026 · updated 25/10/2026

In short

CVE-2026-22815 is a HIGH (CVSS 7.5) vulnerability affecting aiohttp, aiohttp (aiohttp).
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 39.7% of all vulnerabilities.
Fix: update to 3.13.4 or later.

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.13.4`	`3.13.4`
aiohttp aiohttp	`< 3.13.4`	`3.13.4`

Description

Summary

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.

Impact

An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.

Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.

References

aio-libs/aiohttp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22815 · ADVISORY
aio-libs/aiohttp commit 0c2e9da · WEB
aio-libs/aiohttp · PACKAGE
aio-libs/aiohttp release v3.13.4 · WEB

More vulnerabilities in aiohttp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

aiohttp

PyPI

< 3.13.4

3.13.4

aiohttp

< 3.13.4

3.13.4

Description

Summary

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.

Impact

Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36

NVD description

More vulnerabilities in aiohttp

See all →