CVE-2026-69244: AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Vulnerability summary

CVE-2026-69244 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in aio-libs aiohttp. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities.

Timeline

1. 03-08-2026
   PublishedVulnerability first disclosed.
2. 04-08-2026
   Last modifiedVulnerability information updated.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.