Vulnerability in Aio-Libs Aiohttp
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
Affected products
- Aio-libs Aiohttp — versions < 3.14.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-69243?
- CVE-2026-69243 is a vulnerability in Aio-Libs Aiohttp, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). Published 2026-08-03.
- Is CVE-2026-69243 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.