CVE-2026-69244

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

CVSS Metrics

• v4.0•HIGH•Score: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• v4.0•HIGH•Score: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.30%• Percentile: 23%

Techniques & Countermeasures

• CWE-125•Out-of-bounds Read

  The product reads data past the end, or before the beginning, of the intended buffer.

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

• CWE-416•Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

• aio-libs•aiohttp

  < 3.14.3

• chainguard•airflow-2

  all

• chainguard•airflow-3

  < 3.3.1-r1 | < 3.3.0-r4

• chainguard•airflow-3-iamguarded-compat

  all

• chainguard•airflow-core-2

  < 2.11.2-r6

• chainguard•apache-beam-python-3.11-sdk

  < 2.75.0-r2

• chainguard•apache-beam-python-3.12-sdk

  < 2.75.0-r1

• chainguard•apache-beam-python-3.13-sdk

  < 2.75.0-r2

• chainguard•awx

  < 24.6.1-r49

• chainguard•dask-kubernetes

  < 2026.3.0-r11

• chainguard•dask-kubernetes-fips

  < 2026.3.0-r6 | < 2026.3.0-r5

• chainguard•datahub-ingestion-fips

  < 1.6.0-r9

• chainguard•kserve

  all

• chainguard•kserve-localmodel

  < 0.20.0-r7

• chainguard•kserve-models-web-app

  < 1.0.1-r2

• chainguard•kserve-storage-controller

  < 0.19.0-r5 | all | < 0.20.0-r7

• chainguard•lmcache-cuda-12.8

  < 0.5.3-r0

• chainguard•open-webui

  < 0.11.0-r6

• chainguard•puppygraph-python

  < 0.1.6-r2

• chainguard•py3-cassandra-medusa

  < 0.29.1-r1

• chainguard•py3.10-vllm-cuda-12.4

  < 0.18.1-r7

• chainguard•py3.12-vllm-cuda-12.4

  < 0.18.1-r7

• chainguard•py3.13-scanner-test-libraries-aiohttp

  < 0.0.1-r4

• chainguard•text-generation-inference

  < 3.3.7-r23

• chainguard•tritonserver-backend-vllm-cuda-13.0

  < 25.11-r11

• chainguard•vllm-cuda-13.2

  < 0.26.0-r0

• wolfi•airflow-3

  < 3.3.1-r1 | < 3.3.0-r4

• wolfi•airflow-3-iamguarded-compat

  all

• wolfi•dask-kubernetes

  < 2026.3.0-r11

• wolfi•kserve

  all

• wolfi•kserve-localmodel

  < 0.20.0-r7

• wolfi•kserve-storage-controller

  < 0.19.0-r5 | all | < 0.20.0-r7

• wolfi•open-webui

  < 0.11.0-r6

• wolfi•py3-cassandra-medusa

  < 0.29.1-r1

• debian•python-aiohttp

  all | all | all | all

• ubuntu•python-aiohttp

  all

• PyPI•aiohttp

  < 3.14.3

References (12)

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273
• https://github.com/aio-libs/aiohttp/pull/13223
• https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3
• https://github.com/aio-libs/aiohttp
• https://pypi.org/project/aiohttp
• https://github.com/advisories/GHSA-cq5v-8q36-5273
• https://nvd.nist.gov/vuln/detail/CVE-2026-69244
• https://ubuntu.com/security/CVE-2026-69244
• https://www.cve.org/CVERecord?id=CVE-2026-69244
• https://security-tracker.debian.org/tracker/CVE-2026-69244
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69244.json