CVE-2026-69243

Received Received - Intake

HTTP Request Smuggling in AIOHTTP via WebSocket Upgrade

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-69243

Affected Vendors & Products

Vendor	Product	Version / Range
aiohttp	aiohttp	to 3.14.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

AIOHTTP before 3.14.2 has a request smuggling vulnerability in its HTTP parsers related to WebSocket upgrades. An attacker could exploit this by sending a WebSocket upgrade request with a body, causing the parser to switch protocols before receiving the full request body. This leaves trailing bytes to be misinterpreted as protocol or pipelined data instead of HTTP body data.

Detection Guidance

Detecting this vulnerability requires checking if your aiohttp server is running a version prior to 3.14.2. Use commands like 'pip show aiohttp' or 'pip list | grep aiohttp' to check the installed version. If the version is below 3.14.2, the system is vulnerable.

Impact Analysis

If you use the server-side component of AIOHTTP before 3.14.2, an attacker may exploit this to smuggle requests, potentially bypassing security controls, accessing unauthorized data, or disrupting services. The impact depends on the application's use case and deployment.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if exploited, leading to legal or regulatory penalties.

Mitigation Strategies

Upgrade aiohttp to version 3.14.2 or later immediately. Use 'pip install --upgrade aiohttp' to update. If upgrading is not possible, disable WebSocket upgrades or restrict access to the server until the update is applied.

Hi! I’m here to help you understand CVE-2026-69243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70