CVE-2026-69243: AIOHTTP: HTTP request smuggling via WebSocket upgrade
Vulnerability summary
CVE-2026-69243 is a medium (CVSS 6.3) vulnerability in aio-libs aiohttp. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 6Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.44% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard25 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.3.1-r1 | < 3.3.0-r4
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- airflow-core-2< 2.11.2-r6
- apache-beam-python-3.11-sdk< 2.75.0-r2
Wolfi8 products
- airflow-3< 3.3.1-r1 | < 3.3.0-r4
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- dask-kubernetes< 2026.3.0-r11
- kserve< 0.20.0-r7
- kserve-localmodel< 0.20.0-r7
Aio-libs1 product
- aiohttp< 3.14.2
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.14.3-1
PyPI1 product
- aiohttp< 3.14.2
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
6 vendors · 37 products
References
12 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22vX Refsource CONFIRMWEBREPORTAdvisory
- github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98X Refsource MISCWEBREPORTFIX
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE
