{"id":"CVE-2026-22815","title":"aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling (CVE-2026-22815)","summary":"A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Servi…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["lightspeed_core","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","satellite 6"],"patched":["aiohttp 3.13.4"],"published":"2026-04-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:33:42+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-22815"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454093"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22815"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.0044,"epssPercentile":0.38075,"aliases":["GHSA-w2fm-2cpv-w7v5","PYSEC-2026-2094"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:03.978Z","slug":"CVE-2026-22815","body":"## Overview\n\nA flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Service (DoS) condition, making the affected web server unavailable.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json)\n\n**aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling** — rated Moderate by Red Hat. Released 2026-04-01, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nNo fix planned:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-22815)\n\nAffected packages:\n\n- `aiohttp < 3.13.4`\n\nPatched in:\n\n- `aiohttp 3.13.4`\n\nSource: https://osv.dev/vulnerability/GHSA-w2fm-2cpv-w7v5","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222195,"id":"CVE-2026-22815","ts":1792065061005,"field":"cvss","old":null,"new":"5.3"}]}