CVE-2026-111750

Summary

AIOHTTP: Pure-Python parser request smuggling

Severity

medium

EPSS

0.4% (p32)

CWE

CWE-444

Also known as

GHSA-pqxq-w44r-73xw

Published

2026-10-20

Updated

2026-10-20

Advisory details

Summary

The pure Python parser is vulnerable to an HTTP request smuggling attack.

Impact

If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.

Workaround

Switch to the default C parser.

References

• https://github.com/advisories/GHSA-pqxq-w44r-73xw
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw
• https://nvd.nist.gov/vuln/detail/CVE-2026-111750
• https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

Related advisories

• CVE-2026-69243 — medium · PyPI/aiohttp
• CVE-2026-111066 — high · PyPI/aiohttp
• CVE-2026-111064 — high · PyPI/aiohttp
• GHSA-2g87-pp6c-29x5 — high · PyPI/aiohttp
• CVE-2026-69244 — high · PyPI/aiohttp
• CVE-2025-69223 — high · PyPI/aiohttp
• CVE-2026-111748 — medium · PyPI/aiohttp
• CVE-2026-111065 — medium · PyPI/aiohttp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity