CVE-2026-69243

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.43%• Percentile: 37%

Techniques & Countermeasures

• CWE-444•Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

  The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected Systems

• aio-libs•aiohttp

  < 3.14.2

• chainguard•airflow-2

  all

• chainguard•airflow-3

  < 3.3.1-r1 | < 3.3.0-r4

• chainguard•airflow-3-iamguarded-compat

  all

• chainguard•airflow-core-2

  < 2.11.2-r6

• chainguard•apache-beam-python-3.11-sdk

  < 2.75.0-r2

• chainguard•apache-beam-python-3.12-sdk

  < 2.75.0-r1

• chainguard•apache-beam-python-3.13-sdk

  < 2.75.0-r2

• chainguard•awx

  < 24.6.1-r49

• chainguard•dask-kubernetes

  < 2026.3.0-r11

• chainguard•dask-kubernetes-fips

  < 2026.3.0-r5 | < 2026.3.0-r6

• chainguard•datahub-ingestion-fips

  < 1.6.0-r9

• chainguard•kserve

  < 0.20.0-r7

• chainguard•kserve-localmodel

  < 0.20.0-r7

• chainguard•kserve-models-web-app

  < 1.0.1-r2

• chainguard•kserve-storage-controller

  < 0.19.0-r5 | all | < 0.20.0-r7

• chainguard•lmcache-cuda-12.8

  < 0.5.3-r0

• chainguard•open-webui

  < 0.11.0-r6

• chainguard•puppygraph-python

  < 0.1.6-r2

• chainguard•py3-cassandra-medusa

  < 0.29.1-r1

• chainguard•py3.10-vllm-cuda-12.4

  < 0.18.1-r7

• chainguard•py3.12-vllm-cuda-12.4

  < 0.18.1-r7

• chainguard•py3.13-scanner-test-libraries-aiohttp

  < 0.0.1-r4

• chainguard•text-generation-inference

  < 3.3.7-r23

• chainguard•tritonserver-backend-vllm-cuda-13.0

  < 25.11-r11

• wolfi•airflow-3

  < 3.3.1-r1 | < 3.3.0-r4

• wolfi•airflow-3-iamguarded-compat

  all

• wolfi•dask-kubernetes

  < 2026.3.0-r11

• wolfi•kserve

  < 0.20.0-r7

• wolfi•kserve-localmodel

  < 0.20.0-r7

• wolfi•kserve-storage-controller

  < 0.19.0-r5 | all | < 0.20.0-r7

• wolfi•open-webui

  < 0.11.0-r6

• wolfi•py3-cassandra-medusa

  < 0.29.1-r1

• debian•python-aiohttp

  all | all | all | all

• ubuntu•python-aiohttp

  all

• PyPI•aiohttp

  < 3.14.2

References (12)

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v
• https://github.com/aio-libs/aiohttp/pull/13017
• https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2
• https://github.com/aio-libs/aiohttp
• https://pypi.org/project/aiohttp
• https://github.com/advisories/GHSA-mfx4-hv73-q22v
• https://nvd.nist.gov/vuln/detail/CVE-2026-69243
• https://ubuntu.com/security/CVE-2026-69243
• https://www.cve.org/CVERecord?id=CVE-2026-69243
• https://security-tracker.debian.org/tracker/CVE-2026-69243
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69243.json