--- id: CVE-2026-69243 title: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python summary: >- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack… severity: high cvss: 7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L' cwe: - CWE-444 vendor: Red Hat product: Red Hat OpenShift AI 2.25 affected: - exploit_intelligence - lightspeed_core - migration_toolkit_for_applications 8 - openshift_lightspeed - ai_inference_server - ansible_automation_platform 2 - ansible_automation_platform_ansible_core 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - update_infrastructure_4_for_cloud_providers - update_infrastructure 5 - ansible_automation_platform_2_5_for_rhel 8 - satellite_6_16_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - satellite_6_18_for_rhel 9 - satellite_6_19_for_rhel 9 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - discovery 2 - openshift_ai 2.25 - openshift_ai 3.4 - satellite 6.18 - satellite 6.19 patched: - ansible_automation_platform_2_5_for_rhel 8 - satellite_6_16_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - satellite_6_18_for_rhel 9 - satellite_6_19_for_rhel 9 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - discovery 2 - openshift_ai 2.25 - openshift_ai 3.4 - satellite 6.18 - satellite 6.19 published: '2026-08-03' updated: '2026-09-10' sourceUpdated: '2026-09-10T20:36:14.340' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69243' references: - url: >- https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98 label: security-advisories@github.com - url: 'https://github.com/aio-libs/aiohttp/pull/13017' label: security-advisories@github.com - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2' label: security-advisories@github.com - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69243.json - url: 'https://access.redhat.com/security/cve/CVE-2026-69243' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510831' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-69243' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69243' - url: 'https://access.redhat.com/errata/RHSA-2026:59135' - url: 'https://access.redhat.com/errata/RHSA-2026:63327' - url: 'https://access.redhat.com/errata/RHSA-2026:59136' - url: 'https://access.redhat.com/errata/RHSA-2026:63387' - url: 'https://access.redhat.com/errata/RHSA-2026:63386' - url: 'https://access.redhat.com/errata/RHSA-2026:63385' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:59153' - url: 'https://access.redhat.com/errata/RHSA-2026:54760' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://access.redhat.com/errata/RHSA-2026:60520' - url: 'https://access.redhat.com/errata/RHSA-2026:63334' - url: 'https://access.redhat.com/errata/RHSA-2026:63337' - url: 'https://github.com/advisories/GHSA-mfx4-hv73-q22v' - url: 'https://github.com/aio-libs/aiohttp' - url: 'https://access.redhat.com/errata/RHSA-2026:68696' - url: 'https://access.redhat.com/errata/RHSA-2026:68699' - url: 'https://access.redhat.com/errata/RHSA-2026:68698' - url: 'https://access.redhat.com/errata/RHSA-2026:68697' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:68770' - url: 'https://access.redhat.com/errata/RHSA-2026:68775' tags: - nvd - exploit-available - csaf - vex - red-hat - ghsa - pip - osv epss: 0.00431 epssPercentile: 0.36829 exploits: github: 1 githubRepos: - 'https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling' checkedAt: '2026-09-21T15:30:16.444Z' exploitAvailable: true aliases: - GHSA-mfx4-hv73-q22v - PYSEC-2026-3546 ecosystem: pip cvssSource: vendor ingestedAt: '2026-08-03T21:30:01.573Z' --- ## Overview AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-69243) Affected packages: - `aiohttp <= 3.14.1` Patched in: - `aiohttp 3.14.2` Source: https://github.com/advisories/GHSA-mfx4-hv73-q22v ## Vendor advisories - **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135) - **RHSA-2026:63327** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63327) - **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136) - **RHSA-2026:63387** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63387) - **RHSA-2026:63386** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63386) - **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:59153** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59153) - **RHSA-2026:54760** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54760) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) - **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Update Infrastructure 4 for Cloud Providers, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69243.json) - **RHSA-2026:68696** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68696) - **RHSA-2026:68699** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68699) - **RHSA-2026:68698** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68698) - **RHSA-2026:68697** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68697)