vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-69243

AIOHTTP: HTTP request smuggling via WebSocket upgrade

MEDIUM
6.3
CVSS Score
Published: August 3, 2026 at 08:45 PM UTC
Updated: October 23, 2026 at 09:10 PM UTC
1 product affected across 1 vendorAiohttp

Using aiohttp by aio-libs?

Get instant alerts when new vulnerabilities affect aiohttp - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.3
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Aiohttp· Aio Libspypi
90%
v < 3.14.2
Affected range stops below 3.14.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_CONFIRM
Source: cverecord
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v
x_refsource_MISC
Source: cverecord
https://github.com/aio-libs/aiohttp/pull/13017
x_refsource_MISC
Source: cverecord
https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
x_refsource_MISC
Source: cverecord
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.3MEDIUMGitHub_M
Vector?

Quick Info

StatusUNDERGOING ANALYSIS
CWE
CWE-444

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card