GHSA-w2fm-2cpv-w7v5

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

En bref

Publiée: 2026-04-01 19:45 UTC
Mise à jour: 2026-09-10 03:51 UTC
CVE: CVE-2026-22815
Alias: PYSEC-2026-2094
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

### Summary Insufficient restrictions in header/trailer handling could cause uncapped memory usage. ### Impact An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36

Paquets affectés

Paquet	Versions
PyPI · aiohttp	introduced 0, fixed 3.13.4

Références

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5 WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-22815 ADVISORY
https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36 WEB
https://github.com/aio-libs/aiohttp PACKAGE
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database