CVE-2026-69243 json
AIOHTTP: HTTP request smuggling via WebSocket upgrade
published 3mo ago modified 19d ago also EUVD-2026-52436 , GHSA-mfx4-hv73-q22v , PYSEC-2026-3546
- cvss
- 6.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Patch / fix
- pypi aiohttp 3.14.2
- aiohttp aiohttp 3.14.2
- python-aiohttp Debian 12 3.8.4-1+deb12u2
- python-aiohttp Debian 14 3.14.3-1
debian advisories DEBIAN-CVE-2026-69243
- rubygem-jwt satellite utils 6.19, satellite utils 6.18, satellite utils 6.17 +9 more 2.10.3-1.el9sat
- ansible-core satellite maintenance 6.19, satellite maintenance 6.18, satellite maintenance 6.17 +6 more 1:2.16.19-1.el9sat
- ansible-test satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 1:2.16.19-1.el9sat
- openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.15.2-1.el9sat
- python-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
- python3.11-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
- python3.12-aiohttp satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 3.14.3-1.el9pc
- python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc
red hat advisories RHSA-2026:63387RHSA-2026:63385RHSA-2026:63386RHSA-2026:63327RHSA-2026:59135RHSA-2026:59136
- python-aiohttp SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 3.6.0-150100.3.41.1
- python-aiohttp SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP4 3.9.3-150400.10.46.1
- python-aiohttp SLES for SAP applications 16.0, SLES 16.0 3.11.16-160000.7.1
suse advisories SUSE-SU-2026:4113-1SUSE-SU-2026:4031-1SUSE-SU-2026:23571-1
- python-aiohttp openSUSE Leap 16.0 3.11.16-160000.7.1
- python-aiohttp openSUSE Tumbleweed 3.14.3-1.1
opensuse advisories openSUSE-SU-2026:21687-1openSUSE-SU-2026:11467-1
- github.com/aio-libs/aiohttp@6ae358f commit
- github.com/aio-libs/aiohttp#13017 pull request
- github.com/aio-libs/aiohttp/releases/tag/v3.14.2 release
Is CVE-2026-69243 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-69243 updated cvss 7.0
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
-
Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9affected: no fix planned “Out of support scope”
-
Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9affected: no fix available
-
Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaii/vllm-neuron-rhel9, rhaiis/vllm-neuron-rhel9, +1 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat Ansible Automation Platform 2 python-aiohttp 3.9.5-1.el9ap, python3x-aiohttp 3.9.5-1.el8ap, python3.11-aiohttp 3.9.5-1.el9ap, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-24/controller-rhel8, +20 moreaffected: no fix available, no fix planned “Out of support scope”
-
Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9affected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9affected: no fix planned “Will not fix”
-
Red Hat OpenShift AI (RHOAI) rhai/guidellm-rhel9, rhoai/odh-mlflow-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more Red Hat Satellite 6 python-aiohttp, python3-aiohttpaffected: no fix available
-
Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp 3.9.5-1.el9apaffected: no fix planned “Out of support scope”
show 23 moreshow fewer
-
Red Hat Update Infrastructure 5 rhui5/rhua-rhel9, rhui5/rhua-tp-rhel9affected: no fix available, no fix planned “Will not fix”
-
Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1790621714fixed: vendor fix RHSA-2026:73859
-
Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287fixed: vendor fix RHSA-2026:68696
-
Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1790109620, rhaii/vllm-spyre-rhel9 1790076141fixed: vendor fix RHSA-2026:70965
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-aiohttp 3.14.3-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9apfixed: vendor fix RHSA-2026:59135
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1787220598, ansible-automation-platform-26/lightspeed-rhel9 1787244079, ansible-automation-platform-26/ee-supported-rhel9 1787217357, ansible-automation-platform-26/platform-resource-runner-rhel9 1791908620fixed: vendor fix RHSA-2026:59155
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9ap, automation-controller-venv-tower 4.7.16-1.el9apfixed: vendor fix RHSA-2026:59136
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/ee-minimal-rhel9 1787217391, ansible-automation-platform-27/lightspeed-rhel9 1787217531, ansible-automation-platform-27/ee-supported-rhel9 1787235693, ansible-automation-platform-27/platform-resource-runner-rhel9 1791219413fixed: vendor fix RHSA-2026:59153
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1786638573fixed: vendor fix RHSA-2026:54760
-
Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 morefixed: vendor fix RHSA-2026:76041
-
Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120, +1 morefixed: vendor fix RHSA-2026:76150
-
Red Hat OpenShift AI 2.25 rhoai/odh-ta-lmes-job-rhel9 1787330903, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-caikit-tgis-serving-rhel9 1787060100, rhoai/odh-kserve-storage-initializer-rhel9 1791257289, rhoai/odh-training-rocm62-torch24-py311-rhel9 1788178712, rhoai/odh-training-rocm62-torch25-py311-rhel9 1788178637, +19 morefixed: vendor fix RHSA-2026:65126
-
Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1789121365, rhoai/odh-llama-stack-core-rhel9 1789121286, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1789570674fixed: vendor fix RHSA-2026:73987
-
Red Hat OpenShift AI 3.4 rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-mlserver-rhel9 1791446063, rhoai/odh-ta-lmes-job-rhel9 1791470318, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-llama-stack-core-rhel9 1790958470, rhoai/odh-kserve-autogluon-server-rhel9 1791300023, +30 morefixed: vendor fix RHSA-2026:84734
-
Red Hat OpenShift AI 3.5 rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlserver-rhel9 1789532398, rhoai/odh-ta-lmes-job-rhel9 1788935863, rhoai/odh-mlserver-cuda-rhel9 1789529984, rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, rhoai/odh-th-torch-cuda-py312-rhel9 1791927642, +23 morefixed: vendor fix RHSA-2026:86891
-
Red Hat Satellite 6.16 for RHEL 8 python-aiohttp 3.14.3-1.el8pc, python3.11-aiohttp 3.14.3-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63327
-
Red Hat Satellite 6.17 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat, python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63387
-
Red Hat Satellite 6.18 satellite/iop-insights-engine-rhel9 1789260306, satellite/iop-vulnerability-engine-rhel9 1788190382fixed: vendor fix RHSA-2026:68770
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc, python3.12-pulpcore 3.73.30-3.el9pc, pulpcore-obsolete-packages 1.3.1-5.el9pcfixed: vendor fix RHSA-2026:63386
-
Red Hat Satellite 6.19 satellite/iop-insights-engine-rhel9 1789273626, satellite/iop-vulnerability-engine-rhel9 1788190224fixed: vendor fix RHSA-2026:68775
-
Red Hat Satellite 6.19 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63385
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9not affected: vulnerable code not in execute path
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-27/controller-rhel9, ansible-automation-platform-27/ee-control-plane-rhel9, ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-hub 4.10.18-1.el8ap, python3.12-django 5.2.17-1.el8ap, python3.12-gitpython 3.1.59-1.el8ap, automation-controller 4.6.32-1.el8ap, python3.12-galaxy-ng 4.10.18-1.el8ap, automation-controller-ui 4.6.32-1.el8ap, +11 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-hub 4.10.18-1.el9ap, python3.12-django 5.2.17-1.el9ap, python3.12-gitpython 3.1.59-1.el9ap, automation-controller 4.6.32-1.el9ap, python3.12-galaxy-ng 4.10.18-1.el9ap, automation-controller-ui 4.6.32-1.el9ap, +11 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/gateway-rhel9 1787219751, ansible-automation-platform-26/gateway-rhel9 1791971533, ansible-automation-platform-26/hub-web-rhel9 1787224278, ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1787202412, +52 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 molecule 26.8.0-1.el9ap, ansible-lint 26.8.0-1.el9ap, python3.12-nh3 0.3.6-1.el9ap, ansible-creator 26.8.0-1.el9ap, automation-hub 4.11.13-1.el9ap, ansible-dev-tools 26.8.0-1.el9ap, +36 morenot affected: vulnerable code not present
15 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | aiohttp | <3.14.2 |
3.14.2 |
Affected products
- aio-libs aiohttp
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
github.com
/aio-libs/aiohttp/pull/13017
web
-
github.com
/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
web
-
github.com
/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v
web, advisory
-
github.com
/aio-libs/aiohttp/releases/tag/v3.14.2
web
-
github.com
/aio-libs/aiohttp
package
-
pypi.org
/project/aiohttp
package
-
github.com
/advisories/GHSA-mfx4-hv73-q22v
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-69243
advisory
Sources
- CVE List CVE-2026-69243
- GitHub Advisory GHSA-mfx4-hv73-q22v
- NVD CVE-2026-69243
- OSV PYSEC-2026-3546
- Maintainer advisory GHSA-mfx4-hv73-q22v
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of aio-libs/aiohttp published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.