Request Smuggling Vulnerability in AIOHTTP Framework by aio-libs
CVE-2026-69243

6.3MEDIUM

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69243?

The AIOHTTP framework, used for asynchronous HTTP client/server communication in Python, harbors a vulnerability that allows for request smuggling due to improper handling of WebSocket upgrade requests. An attacker exploiting this weakness could manipulate HTTP requests, switching protocols before the complete request body is processed. This allows for potential interception and manipulation of network traffic. The issue has been resolved in version 3.14.2, making it essential for users to update to this version to safeguard against such attacks.

Affected Version(s)

aiohttp < 3.14.2

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/pull/13017
x_refsource_MISC
https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.