Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Published: 2026-08-03
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

AIOHTTP’s HTTP parser incorrectly handles a WebSocket upgrade request that includes a body. The parser switches protocols before the entire request body is received, allowing trailing bytes to be processed as upgraded protocol data or as additional pipelined HTTP data. This flaw, identified as CWE-444, can give an attacker the ability to smuggle requests, potentially leading to unintended processing of malicious data by downstream services and violations of confidentiality or integrity.

Affected Systems

The vulnerability affects all installations of aio-libs:aiohttp where the server component is used and the version is earlier than 3.14.2. Client‑side usage is not impacted. Upgrading to 3.14.2 or later eliminates the issue.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploitation yet. An attacker can trigger the flaw by sending a specially crafted WebSocket upgrade request containing a body; no additional privileges or local access are required. If the target service processes the smuggled data unsafely, more severe consequences could follow. Therefore, while the risk is moderate, the potential impact warrants timely remediation.

Generated by OpenCVE AI on August 4, 2026 at 09:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update aiohttp to version 3.14.2 or newer.
  • Configure the server to reject WebSocket upgrade requests that include a body, or enforce strict protocol compliance if an upgrade is mandatory.
  • Monitor network traffic for anomalous upgrade requests and raise alerts for suspicious patterns before applying the patch if an upgrade is delayed.

Generated by OpenCVE AI on August 4, 2026 at 09:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-mfx4-hv73-q22v AIOHTTP: HTTP request smuggling via WebSocket upgrade
History

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}

threat_severity

Moderate

Wed, 05 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Aio-libs
Aio-libs aiohttp
Vendors & Products Aio-libs
Aio-libs aiohttp

Mon, 03 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Title AIOHTTP: HTTP request smuggling via WebSocket upgrade
Weaknesses CWE-444
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aio-libs Aiohttp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-05T14:54:06.962Z

Reserved: 2026-08-03T19:54:19.852Z

Link: CVE-2026-69243

cve-icon Vulnrichment

Updated: 2026-08-05T14:54:03.167Z

cve-icon NVD

Status : Received

Published: 2026-08-03T21:16:42.113

Modified: 2026-08-05T16:17:01.143

Link: CVE-2026-69243

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-03T20:45:43Z

Links: CVE-2026-69243 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T09:45:03Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')