CVE-2026-69243High· 7.0▾ MidnightPoC availableAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 38.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
7 → —
high → medium
— → 7
medium → high
7 → —
high → medium
— → 7
medium → high
7 → —
high → medium
— → 7
medium → high
1 GitHub repo (last check)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
aiohttp <= 3.14.1Patched in:
aiohttp 3.14.2Source: https://github.com/advisories/GHSA-mfx4-hv73-q22v
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73625High· 8.8gitpython: GitPython: Remote Code Execution via kwarg value smuggling (CVE-2026-73625)
CVE-2026-73624High· 8.1GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs
CVE-2026-73622High· 7.5gitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
CVE-2026-73623High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
CVE-2026-69244High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-73415High· 8.0jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture