CVE-2026-69244
published 2026-08-03CVE-2026-69244: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response…
PriorityP336high7.1CVSS 4.0
AVNACLATNPRNUIPVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.53%
43.8th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Affected
123 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.3 | 3.14.3 |
| aiohttp | aiohttp | >= 0 < 3.14.3 | 3.14.3 |
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | de-supported-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
vendor_redhat·2026-08-03·CVSS 7.1
CVE-2026-69244 [HIGH] CWE-125 aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in th
VulDB
aio-libs aiohttp up to 3.14.2 C response parser aiohttp/_http_parser.pyx out-of-bounds
vuldb·2026-08-03·CVSS 7.1
CVE-2026-69244 [HIGH] aio-libs aiohttp up to 3.14.2 C response parser aiohttp/_http_parser.pyx out-of-bounds
A vulnerability, which was classified as critical, was found in aio-libs aiohttp up to 3.14.2. This vulnerability affects unknown code of the file aiohttp/_http_parser.pyx of the component C response parser. The manipulation results in out-of-bounds read.
This vulnerability is cataloged as CVE-2026-69244. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
ghsa·2026-08-03
CVE-2026-69244 [HIGH] CWE-125 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
### Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
### Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
### Workaround
If unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.
---
Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [fedora-all]
bugzilla·2026-08-19·CVSS 7.1
CVE-2026-69244 [HIGH] CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [fedora-all]
CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for ma
Bugzilla
CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [epel-all]
bugzilla·2026-08-19·CVSS 7.1
CVE-2026-69244 [HIGH] CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [epel-all]
CVE-2026-69244 python-aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malf
Bugzilla
CVE-2026-69244 aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
bugzilla·2026-08-03·CVSS 7.1
CVE-2026-69244 [HIGH] CVE-2026-69244 aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
CVE-2026-69244 aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
2026-08-03
Published