What is GHSA-w2fm-2cpv-w7v5?

GHSA-w2fm-2cpv-w7v5 is a security advisory published by GitHub Security Advisories with Medium severity. aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

Which CVE IDs does GHSA-w2fm-2cpv-w7v5 cover?

GHSA-w2fm-2cpv-w7v5 covers the following CVE IDs: CVE-2026-22815. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-w2fm-2cpv-w7v5?

GHSA-w2fm-2cpv-w7v5 affects 1 product, including: pip/aiohttp:\u003c= 3.13.3.

GHSA-w2fm-2cpv-w7v5Medium

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

Vendor

GitHub Security Advisories

Published

April 1, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-22815 →

📋 Description

Summary

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.

Impact

An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.

Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36

🎯 Affected products1

pip/aiohttp:<= 3.13.3

🔗 References (5)

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5
https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
https://nvd.nist.gov/vuln/detail/CVE-2026-22815
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
https://github.com/advisories/GHSA-w2fm-2cpv-w7v5