Listen to this Post
The vulnerability exists in how aiohttp handles HTTP/1.1 trailer headers when chunked transfer encoding is used. By default, the library does not enforce a limit on the number or total size of trailer headers. An attacker can craft a request or response with a massive number of trailer headers or extremely large trailer header values. As the server parses each incoming chunk, it accumulates these trailer headers in memory without restriction. This unbounded allocation leads to uncontrolled memory consumption, potentially causing the application process to exhaust all available memory, resulting in a denial-of-service (DoS) condition. The flaw is triggered during the HTTP/1.1 trailer parsing phase, which occurs after the message body. Since aiohttp processes these trailers before finalizing the request, a single malicious stream can force the server to allocate gigabytes of memory, overwhelming the host. The issue affects both server and client components. The patch introduces configurable limits for the number and size of trailer headers, aligning the behavior with existing header restrictions.
Platform: aiohttp
Version: < patched
Vulnerability : Unbounded trailer memory
Severity: Moderate
date: 2026-04-01
Prediction: Patch already available
What Undercode Say:
Simulate the attack using curl with unlimited trailers printf "POST / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n$(perl -e 'print "X-Trailer: " . "A"x1000000 . "\r\n" for 1..10000')\r\n\r\n" | nc localhost 8080 Check memory usage of the aiohttp process watch -n 1 'ps aux | grep aiohttp'
Exploit:
Craft an HTTP request with chunked transfer encoding and a final chunk size of zero, followed by thousands of large trailer headers. Send this stream slowly to bypass timeouts and force the server to allocate memory for each header line.
Protection from this CVE
Apply the patch from commit aio-libs/aiohttp@0c2e9da. Configure reverse proxy (e.g., nginx) to reject or limit trailers. Use aiohttp’s new `max_trailer_headers` and `max_trailer_header_size` settings.
Impact:
Memory exhaustion leading to application crash or host instability. Affects applications directly handling HTTP requests without a reverse proxy.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
