AIOHTTP Vulnerabilities Expose Web Apps to DoS and Injection Risks
Multiple flaws in the AIOHTTP library could allow attackers to cause denial of service or inject malicious headers. Developers should update immediately.
TL;DR
- Memory exhaustion flaws in HTTP header and multipart processing can lead to DoS.
- Unbounded DNS cache size allows resource depletion attacks.
- Content-type parameter sanitization failure enables HTTP response splitting.
- Four CVEs addressed in Ubuntu security notice USN-8591-1.
- Immediate patching recommended for applications using AIOHTTP.
The popular Python asynchronous HTTP client/server library AIOHTTP has been found to contain multiple vulnerabilities that could be exploited by attackers. These issues range from improper resource management leading to denial of service, to input sanitization failures that enable HTTP response splitting.
Ubuntu has released security notice USN-8591-1 addressing these concerns, urging developers to apply updates. Organizations relying on AIOHTTP should prioritize patching to avoid potential service disruptions or security breaches.
Denial of Service via Resource Exhaustion
- CVE-2026-22815 affects memory handling during HTTP header and trailer processing
- CVE-2026-34513 involves unbounded DNS cache growth that attackers can exploit
- Both vulnerabilities allow remote attackers to consume excessive system resources
- Successful exploitation leads to service degradation or complete denial of service
Input Sanitization and Injection Risk
- CVE-2026-34514 impacts content_type parameter sanitization in HTTP responses
- This flaw enables HTTP response splitting through malicious header injection
- Attackers could manipulate downstream proxies or web caches
- CVE-2026-34516 affects multipart header processing with similar resource exhaustion risks
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.