Prior to version 3.14.4, the pure‑Python parser of AIOHTTP accepts ambiguous HTTP request framing, letting an unauthenticated attacker smuggle requests. This can cause an intermediary such as a proxy or load balancer to interpret the ambiguous framing differently, potentially leading to undisclosed request execution or sensitive data exposure. The weakness is identified as CWE‑444, a request smuggling vulnerability.

Vulnerable versions of the aio-libs:aiohttp package include all releases prior to 3.14.4. Applications that run without the compiled C extensions, for example by setting AIOHTTP_NO_EXTENSIONS or using plain source packages, are susceptible because the pure‑Python parser is used. The fix is included in 3.14.4 and later releases.

With a CVSS score of 6.3, the vulnerability represents moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can craft a request with ambiguous framing to smuggle additional HTTP requests through an intermediary that parses the framing differently. Because the exploit does not require authentication, the risk is significant to any exposed AIOHTTP service.