{"id":"CVE-2026-111750","title":"AIOHTTP: Pure-Python parser request smuggling","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an applica…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","cvssSource":"cna","cwe":["CWE-444"],"vendor":"aio-libs","product":"aiohttp","affected":["aiohttp < 3.14.4"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T17:06:37.997Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111750","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw","label":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw"},{"url":"https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83","label":"https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","label":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T17:33:42.452Z","slug":"CVE-2026-111750","body":"## Overview\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.\n\n## Affected\n\n- `aiohttp < 3.14.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}