CVE-2026-69243

Summary

AIOHTTP: HTTP request smuggling via WebSocket upgrade

Severity

medium

EPSS

0.4% (p38)

CWE

CWE-444

Also known as

GHSA-mfx4-hv73-q22v

Published

2026-08-03

Updated

2026-08-03

Advisory details

Summary

The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

Impact

If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.

Patch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98

References

• https://github.com/advisories/GHSA-mfx4-hv73-q22v
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v
• https://github.com/aio-libs/aiohttp/pull/13017
• https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2

Related advisories

• CVE-2026-111750 — medium · PyPI/aiohttp
• CVE-2026-111066 — high · PyPI/aiohttp
• CVE-2026-111064 — high · PyPI/aiohttp
• GHSA-2g87-pp6c-29x5 — high · PyPI/aiohttp
• CVE-2026-69244 — high · PyPI/aiohttp
• CVE-2025-69223 — high · PyPI/aiohttp
• CVE-2026-111748 — medium · PyPI/aiohttp
• CVE-2026-111065 — medium · PyPI/aiohttp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity