Log in Start free

Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M

CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgrade

Medium 6.3

In plain English

A medium-severity security flaw in aiohttp from aio-libs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-aiohttp3.8.4-1+deb12u2DEBIAN-CVE-2026-69243
Debian:13python-aiohttpno fix listedDEBIAN-CVE-2026-69243
Debian:14python-aiohttp3.14.3-1DEBIAN-CVE-2026-69243
PyPIaiohttp3.14.2GHSA-mfx4-hv73-q22v
PyPIaiohttp3.14.2PYSEC-2026-3546
Ubuntu:26.10python-aiohttpno fix listedUBUNTU-CVE-2026-69243

Affected products (as reported)

VendorProductVersions
aio-libs aiohttp < 3.14.2

Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References