Insufficient Header Handling in AIOHTTP Framework Leading to Memory Issues

CVE-2026-22815

What is CVE-2026-22815?

AIOHTTP, an asynchronous HTTP client/server framework utilized in Python applications, exhibits a vulnerability due to insufficient restrictions in handling headers and trailers. This design flaw can lead to unbounded memory usage, potentially resulting in Denial of Service (DoS) conditions if exploited. The issue has been addressed in version 3.13.4, where the necessary safeguards to control memory allocation and management in response to header data have been implemented.

References