CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
https://github.com/aio-libs/aiohttp/pull/13017
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) AIOHTTP es un framework cliente/servidor HTTP asíncrono para asyncio y Python. Antes de la versión 3.14.2, los analizadores HTTP eran vulnerables a un ataque de contrabando de solicitudes relacionado con las actualizaciones de WebSocket. Si se utiliza el componente del lado del servidor, un atacante podría ejecutar una vulnerabilidad de contrabando de solicitudes utilizando un caso límite en el procedimiento de actualización de WebSocket. Una solicitud de actualización de WebSocket con un cuerpo podría hacer que el analizador cambiara de protocolo antes de que se recibiera el cuerpo completo de la solicitud, dejando bytes restantes para ser manejados como datos de protocolo actualizado o canalizados en lugar de datos normales del cuerpo HTTP. Este problema está solucionado en la versión 3.14.2.

Information

Published : 2026-08-03 21:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-69243

Mitre link : CVE-2026-69243

CVE.ORG link : CVE-2026-69243

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-69243", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69243", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:53:55.109986Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "aio-libs", "product": "aiohttp", "versions": [{"status": "affected", "version": "< 3.14.2"}]}]}], "published": "2026-08-03T21:16:42.113", "references": [{"url": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98", "source": "security-advisories@github.com"}, {"url": "https://github.com/aio-libs/aiohttp/pull/13017", "source": "security-advisories@github.com"}, {"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v", "source": "security-advisories@github.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2."}, {"lang": "es", "value": "AIOHTTP es un framework cliente/servidor HTTP as\u00edncrono para asyncio y Python. Antes de la versi\u00f3n 3.14.2, los analizadores HTTP eran vulnerables a un ataque de contrabando de solicitudes relacionado con las actualizaciones de WebSocket. Si se utiliza el componente del lado del servidor, un atacante podr\u00eda ejecutar una vulnerabilidad de contrabando de solicitudes utilizando un caso l\u00edmite en el procedimiento de actualizaci\u00f3n de WebSocket. Una solicitud de actualizaci\u00f3n de WebSocket con un cuerpo podr\u00eda hacer que el analizador cambiara de protocolo antes de que se recibiera el cuerpo completo de la solicitud, dejando bytes restantes para ser manejados como datos de protocolo actualizado o canalizados en lugar de datos normales del cuerpo HTTP. Este problema est\u00e1 solucionado en la versi\u00f3n 3.14.2."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "security-advisories@github.com"}