Packages
- python-aiohttp - Asynchronous HTTP client/server Python framework
Details
Sean Gilligan discovered that AIOHTTP did not properly limit memory
usage when processing HTTP headers and trailers. An attacker could
possibly use this issue to consume excessive system resources, resulting
in a denial of service. (CVE-2026-22815)
It was discovered that AIOHTTP did not properly limit the size of its
DNS cache. An attacker could possibly use this issue to consume
excessive system resources, resulting in a denial of service.
(CVE-2026-34513)
Mingi Jung discovered that AIOHTTP did not properly sanitize the
content_type parameter. An attacker could possibly use this issue to
inject malicious HTTP headers, resulting in HTTP response splitting.
(CVE-2026-34514)
It was discovered that AIOHTTP did not properly limit memory usage when
processing multipart headers. An attacker could possibly use...
Sean Gilligan discovered that AIOHTTP did not properly limit memory
usage when processing HTTP headers and trailers. An attacker could
possibly use this issue to consume excessive system resources, resulting
in a denial of service. (CVE-2026-22815)
It was discovered that AIOHTTP did not properly limit the size of its
DNS cache. An attacker could possibly use this issue to consume
excessive system resources, resulting in a denial of service.
(CVE-2026-34513)
Mingi Jung discovered that AIOHTTP did not properly sanitize the
content_type parameter. An attacker could possibly use this issue to
inject malicious HTTP headers, resulting in HTTP response splitting.
(CVE-2026-34514)
It was discovered that AIOHTTP did not properly limit memory usage when
processing multipart headers. An attacker could possibly use this issue
to consume excessive system resources, resulting in a denial of service.
(CVE-2026-34516)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | python3-aiohttp – 3.13.3-3ubuntu1+esm1 | ||
| 24.04 LTS noble | python3-aiohttp – 3.9.1-1ubuntu0.1+esm3 | ||
| 22.04 LTS jammy | python3-aiohttp – 3.8.1-4ubuntu0.2+esm3 | ||
| 20.04 LTS focal | python3-aiohttp – 3.6.2-1ubuntu1+esm6 | ||
| 18.04 LTS bionic | python3-aiohttp – 3.0.1-1ubuntu0.1~esm7 | ||
| 16.04 LTS xenial | python3-aiohttp – 0.20.2-1ubuntu0.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.