GHSA-w2fm-2cpv-w7v5

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-22815

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aiohttp	< 3.13.4	3.13.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Insufficient restrictions in header/trailer handling could cause uncapped memory usage. ### Impact An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36

References

External links from the advisory. They lead to third-party sites.

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5 web
https://nvd.nist.gov/vuln/detail/CVE-2026-22815 advisory
https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36 web
https://github.com/aio-libs/aiohttp package
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 web