{"id":"CVE-2026-22815","aliases":["GHSA-w2fm-2cpv-w7v5","PYSEC-2026-2094"],"title":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","severity":"medium","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.13.4"],"patched":["aiohttp 3.13.4"],"published":"2026-04-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:03.588955358Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-w2fm-2cpv-w7v5","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"tags":["osv","pip"],"epss":0.0044,"epssPercentile":0.3555,"ingestedAt":"2026-07-13T18:58:03.978Z","slug":"CVE-2026-22815","body":"## Overview\n\n### Summary\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.\n\n### Impact\n\nAn application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36\n\n## Affected packages\n\n- `aiohttp < 3.13.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.13.4`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}