Out-of-Bounds Heap Read in AIOHTTP Framework by AIO-Libs

CVE-2026-69244

What is CVE-2026-69244?

A vulnerability in the AIOHTTP framework allows for an out-of-bounds heap read during the construction of error messages for malformed responses. This issue arises from the mishandling of error-message generation based on malformed chunked responses, which can be exploited by an attacker-controlled server or an accidental response. As a result, this flaw can lead to a Denial of Service (DoS) condition in the client. The vulnerability affects versions prior to 3.14.3 and has been addressed in this release.

References