PT-2026-29601 · Aiohttp · Aiohttp

Sg3-141-592 · Published 2026-04-01 · Updated 2026-05-14 · CVE-2026-22815

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description Insufficient restrictions in header/trailer handling could lead to uncapped memory usage. An application could experience memory exhaustion when processing attacker-controlled requests or responses. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.

Recommendations Update to version 3.13.4 or later.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-22815

ECHO-B104-18BE-DBA6

GHSA-W2FM-2CPV-W7V5

OESA-2026-2192

OESA-2026-2193

OESA-2026-2194

Affected Products

Aiohttp

References · 27

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5 · Vendor Advisory
• https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22815 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-22815 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34525 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://ubuntu.com/security/CVE-2026-22815 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34518 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2193 · Vendor Advisory