Skip to content
Fencer Intel
high 7.1

CVE-2026-69244 json

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

published 3mo ago modified 19d ago also EUVD-2026-52438 , GHSA-cq5v-8q36-5273 , PYSEC-2026-3545

cvss
7.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Patch / fix

  • pypi aiohttp 3.14.3
  • aiohttp aiohttp 3.14.3
  • python-aiohttp Debian 14 3.14.3-1

debian advisories DEBIAN-CVE-2026-69244

  • rubygem-jwt satellite utils 6.19, satellite utils 6.18, satellite utils 6.17 +9 more 2.10.3-1.el9sat
  • ansible-core satellite maintenance 6.19, satellite maintenance 6.18, satellite maintenance 6.17 +6 more 1:2.16.19-1.el9sat
  • ansible-test satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 1:2.16.19-1.el9sat
  • openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.15.2-1.el9sat
  • python-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
  • python3.11-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
  • python3.12-aiohttp satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 3.14.3-1.el9pc
  • python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc

red hat advisories RHSA-2026:63387RHSA-2026:63385RHSA-2026:63386RHSA-2026:63327RHSA-2026:59135RHSA-2026:59136

  • python-aiohttp SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP4 3.9.3-150400.10.46.1
  • python-aiohttp SLES for SAP applications 16.0, SLES 16.0 3.11.16-160000.7.1

suse advisories SUSE-SU-2026:4031-1SUSE-SU-2026:23571-1

  • python-aiohttp openSUSE Leap 16.0 3.11.16-160000.7.1
  • python-aiohttp openSUSE Tumbleweed 3.14.3-1.1

opensuse advisories openSUSE-SU-2026:21687-1openSUSE-SU-2026:11467-1

Is CVE-2026-69244 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-69244 updated cvss 7.5

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaii/vllm-neuron-rhel9, rhaiis/vllm-neuron-rhel9, +1 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/de-minimal-rhel8, ansible-automation-platform-25/de-minimal-rhel9, ansible-automation-platform-26/de-minimal-rhel9, +11 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhai/guidellm-rhel9, rhoai/odh-mlflow-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more Red Hat Satellite 6 python-aiohttp, python3-aiohttp
    affected: workaround, no fix available
  • Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp 3.9.5-1.el9ap
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9, rhui5/rhua-tp-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1790621714
    fixed: vendor fix RHSA-2026:73859
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287
    fixed: vendor fix RHSA-2026:68696
show 22 more
  • Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1790109620, rhaii/vllm-spyre-rhel9 1790076141
    fixed: vendor fix RHSA-2026:70965
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1787101922, ansible-automation-platform-25/controller-rhel8 1787171942, ansible-automation-platform-25/lightspeed-rhel8 1787229385
    fixed: vendor fix RHSA-2026:59159
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-aiohttp 3.14.3-1.el8ap, automation-controller-venv-tower 4.6.32-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9ap, automation-controller-venv-tower 4.6.32-1.el9ap
    fixed: vendor fix RHSA-2026:59135
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1787220598, ansible-automation-platform-26/controller-rhel9 1789673739, ansible-automation-platform-26/lightspeed-rhel9 1787244079, ansible-automation-platform-26/ee-supported-rhel9 1787217357
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9ap, automation-controller-venv-tower 4.7.16-1.el9ap
    fixed: vendor fix RHSA-2026:59136
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/controller-rhel9 1788918363, ansible-automation-platform-27/ee-minimal-rhel9 1787217391, ansible-automation-platform-27/lightspeed-rhel9 1787217531, ansible-automation-platform-27/ee-supported-rhel9 1787235693
    fixed: vendor fix RHSA-2026:67279
  • Red Hat Ansible Automation Platform 2.18 ansible-automation-platform/ee-minimal-rhel8 1786971288, ansible-automation-platform/ee-minimal-rhel9 1786942232
    fixed: vendor fix RHSA-2026:55853
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 1786638573
    fixed: vendor fix RHSA-2026:54760
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 more
    fixed: vendor fix RHSA-2026:76041
  • Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120, +1 more
    fixed: vendor fix RHSA-2026:76150
  • Red Hat OpenShift AI 2.25 rhoai/odh-ta-lmes-job-rhel9 1787330903, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-caikit-tgis-serving-rhel9 1787060100, rhoai/odh-kserve-storage-initializer-rhel9 1791257289, rhoai/odh-training-rocm62-torch24-py311-rhel9 1788178712, rhoai/odh-training-rocm62-torch25-py311-rhel9 1788178637, +20 more
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1789121365, rhoai/odh-llama-stack-core-rhel9 1789121286, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1789570674
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-mlserver-rhel9 1791446063, rhoai/odh-ta-lmes-job-rhel9 1791470318, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-llama-stack-core-rhel9 1790958470, rhoai/odh-kserve-autogluon-server-rhel9 1791300023, +31 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI 3.5 rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlserver-rhel9 1789532398, rhoai/odh-ta-lmes-job-rhel9 1788935863, rhoai/odh-mlserver-cuda-rhel9 1789529984, rhoai/odh-th-torch-cpu-py312-rhel9 1789702699, rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, +29 more
    fixed: vendor fix RHSA-2026:86891
  • Red Hat Satellite 6.16 for RHEL 8 python-aiohttp 3.14.3-1.el8pc, python3.11-aiohttp 3.14.3-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63327
  • Red Hat Satellite 6.17 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat, python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63387
  • Red Hat Satellite 6.18 satellite/iop-insights-engine-rhel9 1789260306, satellite/iop-vulnerability-engine-rhel9 1788190382
    fixed: vendor fix RHSA-2026:68770
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc, python3.12-pulpcore 3.73.30-3.el9pc, pulpcore-obsolete-packages 1.3.1-5.el9pc
    fixed: vendor fix RHSA-2026:63386
  • Red Hat Satellite 6.19 satellite/iop-insights-engine-rhel9 1789273626, satellite/iop-vulnerability-engine-rhel9 1788190224
    fixed: vendor fix RHSA-2026:68775
  • Red Hat Satellite 6.19 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63385
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat Ansible Automation Platform 2 python-aiohttp 3.9.5-1.el9ap, python3x-aiohttp 3.9.5-1.el8ap, python3.11-aiohttp 3.9.5-1.el9ap, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-24/de-supported-rhel9, +5 more Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/gateway-rhel8 1787100608, ansible-automation-platform-25/hub-web-rhel8 1787185021, ansible-automation-platform-25/receptor-rhel8 1787100120, ansible-automation-platform-25/de-minimal-rhel8 1787223460, ansible-automation-platform-25/ee-minimal-rhel8 1787218259, ansible-automation-platform-25/de-supported-rhel8 1787225360, +18 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-hub 4.10.18-1.el8ap, python3.12-django 5.2.17-1.el8ap, python3.12-gitpython 3.1.59-1.el8ap, automation-controller 4.6.32-1.el8ap, python3.12-galaxy-ng 4.10.18-1.el8ap, automation-controller-ui 4.6.32-1.el8ap, +10 more
    not affected: vulnerable code not present

18 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
pypi aiohttp
<3.14.3
3.14.3

Affected products

  • aio-libs aiohttp

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of aio-libs/aiohttp published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.