CVE-2026-22815Medium· 5.3▾ SunlitA flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Servi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
— → 5.3
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Service (DoS) condition, making the affected web server unavailable.
aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling — rated Moderate by Red Hat. Released 2026-04-01, updated 2026-10-15.
Affected:
No fix planned:
Fix deferred
Workarounds / mitigations:
Affected packages:
aiohttp < 3.13.4Patched in:
aiohttp 3.13.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-111064High· 7.5aiohttp: aiohttp: Denial of Service via missing initial request timeout (CVE-2026-111064)
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-59881Medium· 5.3aiohttp: AIOHTTP: Denial of Service via unnegotiated WebSocket compression (CVE-2026-59881)
CVE-2026-49855High· 7.5tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)