CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

April 1, 2026 (updated April 6, 2026)

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.

References

github.com/advisories/GHSA-w2fm-2cpv-w7v5
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
github.com/aio-libs/aiohttp/releases/tag/v3.13.4
github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5
nvd.nist.gov/vuln/detail/CVE-2026-22815

Code Behaviors & Features

Detect and mitigate CVE-2026-22815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →