---
id: CVE-2026-22815
title: >-
  aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling
  (CVE-2026-22815)
summary: >-
  A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for
  Python. Insufficient restrictions in header and trailer handling could allow a
  remote attacker to cause uncapped memory usage. This can lead to a Denial of
  Servi…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - lightspeed_core
  - openshift_lightspeed
  - ai_inference_server
  - ansible_automation_platform 2
  - ansible_automation_platform_ansible_core 2
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - satellite 6
patched:
  - aiohttp 3.13.4
published: '2026-04-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:33:42+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-22815'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2454093'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-22815'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22815'
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4'
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5
  - url: 'https://github.com/aio-libs/aiohttp'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.0044
epssPercentile: 0.38075
aliases:
  - GHSA-w2fm-2cpv-w7v5
  - PYSEC-2026-2094
ecosystem: pip
ingestedAt: '2026-07-13T18:58:03.978Z'
---

## Overview

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Service (DoS) condition, making the affected web server unavailable.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22815.json)

**aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling** — rated Moderate by Red Hat. Released 2026-04-01, updated 2026-10-15.

Affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat Satellite 6

No fix planned:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat Satellite 6

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2026-22815)

Affected packages:

- `aiohttp < 3.13.4`

Patched in:

- `aiohttp 3.13.4`

Source: https://osv.dev/vulnerability/GHSA-w2fm-2cpv-w7v5