CVE-2026-69243
Fixed in a distro release EPSS <1%CVSS 6.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.14.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-3 | 3.3.1-r1 |
| Chainguard | airflow-3 | 3.3.0-r4 |
| Chainguard | airflow-core-2 | 2.11.2-r6 |
| Chainguard | apache-beam-python-3.11-sdk | 2.75.0-r2 |
| Chainguard | apache-beam-python-3.12-sdk | 2.75.0-r1 |
| Chainguard | apache-beam-python-3.13-sdk | 2.75.0-r2 |
| Chainguard | awx | 24.6.1-r49 |
| Chainguard | dask-kubernetes | 2026.3.0-r11 |
| Chainguard | dask-kubernetes-fips | 2026.3.0-r5 |
| Chainguard | dask-kubernetes-fips | 2026.3.0-r6 |
| Chainguard | datahub-ingestion-fips | 1.6.0-r9 |
| Chainguard | kserve | 0.20.0-r7 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r4 |
| Chainguard | kserve-localmodel | 0.20.0-r7 |
| Chainguard | kserve-models-web-app | 1.0.1-r2 |
| Chainguard | kserve-storage-controller | 0.20.0-r7 |
| Chainguard | kserve-storage-controller | no fix |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | open-webui | 0.11.0-r6 |
| Chainguard | puppygraph-python | 0.1.6-r2 |
| Chainguard | py3-cassandra-medusa | 0.29.1-r1 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.18.1-r7 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.18.1-r7 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r4 |
| Chainguard | text-generation-inference | 3.3.7-r23 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r11 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | no fix |
| Debian 14 | python-aiohttp | 3.14.3-1 |
| Red Hat ansible automation platform 2.5 | automation-controller-cli | 0:4.6.32-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-cli | 0:4.6.32-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.32-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.32-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260824-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260824-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-aiohttp | 0:3.14.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-aiohttp | 0:3.14.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-django | 0:5.2.17-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-django | 0:5.2.17-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.59-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.59-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.16-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.16-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.13-1.el9ap |
| Red Hat ansible automation platform 2.6 | python-django | 0:5.2.17-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3-django | 0:5.2.17-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3.12-aiohttp | 0:3.14.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-aiohttp-debuginfo | 0:3.14.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-aiohttp-debugsource | 0:3.14.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-django | 0:5.2.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-gitpython | 0:3.1.59-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller-cli | 0:4.6.32-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | automation-controller-cli | 0:4.6.32-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-django | 0:5.2.17-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-django | 0:5.2.17-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.16-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python-django | 0:5.2.17-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3-django | 0:5.2.17-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-django | 0:5.2.17-1.el9ap |
| Red Hat satellite 6.16 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite 6.16 | openvox-server | 0:8.15.2-1.el8sat |
| Red Hat satellite 6.16 | python-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.16 | python-aiohttp | 0:3.14.3-1.el8pc |
| Red Hat satellite 6.16 | python-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.16 | python-aiohttp-debugsource | 0:3.14.3-1.el8pc |
| Red Hat satellite 6.16 | python3.11-aiohttp | 0:3.14.3-1.el8pc |
| Red Hat satellite 6.16 | python3.11-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.16 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el8pc |
| Red Hat satellite 6.16 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.16 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite 6.16 | rubygem-jwt | 0:2.10.3-1.el8sat |
| Red Hat satellite 6.17 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.17 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.17 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite 6.17 | python-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.17 | python-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.17 | python3.11-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.17 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.17 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite 6.18 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.18 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.18 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite 6.18 | pulpcore-obsolete-packages | 0:1.3.1-5.el9pc |
| Red Hat satellite 6.18 | python3.12-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-pulpcore | 0:3.73.30-3.el9pc |
| Red Hat satellite 6.18 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite 6.19 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.19 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite 6.19 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite 6.19 | python3.12-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.19 | python3.12-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.19 | python3.12-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite 6.19 | python3.12-gitpython | 0:3.1.59-1.el9pc |
| Red Hat satellite 6.19 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite capsule 6.16 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite capsule 6.16 | openvox-server | 0:8.15.2-1.el8sat |
| Red Hat satellite capsule 6.16 | python-aiohttp | 0:3.14.3-1.el8pc |
| Red Hat satellite capsule 6.16 | python-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.16 | python-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.16 | python-aiohttp-debugsource | 0:3.14.3-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp | 0:3.14.3-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el8pc |
| Red Hat satellite capsule 6.16 | rubygem-jwt | 0:2.10.3-1.el8sat |
| Red Hat satellite capsule 6.16 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite capsule 6.17 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.17 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.17 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite capsule 6.17 | python-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.17 | python-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.17 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite capsule 6.18 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.18 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.18 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite capsule 6.18 | pulpcore-obsolete-packages | 0:1.3.1-5.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-pulpcore | 0:3.73.30-3.el9pc |
| Red Hat satellite capsule 6.18 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite capsule 6.19 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.19 | ansible-test | 1:2.16.19-1.el9sat |
| Red Hat satellite capsule 6.19 | openvox-server | 0:8.15.2-1.el9sat |
| Red Hat satellite capsule 6.19 | python3.12-aiohttp | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-aiohttp-debuginfo | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-aiohttp-debugsource | 0:3.14.3-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-gitpython | 0:3.1.59-1.el9pc |
| Red Hat satellite capsule 6.19 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite maintenance 6.17 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite maintenance 6.18 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite maintenance 6.19 | ansible-core | 1:2.16.19-1.el9sat |
| Red Hat satellite utils 6.16 | rubygem-jwt | 0:2.10.3-1.el8sat |
| Red Hat satellite utils 6.16 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite utils 6.17 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite utils 6.18 | rubygem-jwt | 0:2.10.3-1.el9sat |
| Red Hat satellite utils 6.19 | rubygem-jwt | 0:2.10.3-1.el9sat |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.41.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.46.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.41.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.41.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP7 | python-aiohttp | 3.6.0-150100.3.41.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-aiohttp | 3.9.3-150400.10.46.1 |
| SUSE Linux Enterprise Server 16.0 | python-aiohttp | 3.11.16-160000.7.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-aiohttp | 3.11.16-160000.7.1 |
| Ubuntu 26.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 22.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 24.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | airflow-3 | 3.3.1-r1 |
| Wolfi | airflow-3 | 3.3.0-r4 |
| Wolfi | dask-kubernetes | 2026.3.0-r11 |
| Wolfi | kserve | 0.20.0-r7 |
| Wolfi | kserve-localmodel | 0.20.0-r7 |
| Wolfi | kserve-storage-controller | no fix |
| Wolfi | kserve-storage-controller | 0.20.0-r7 |
| Wolfi | open-webui | 0.11.0-r6 |
| Wolfi | py3-cassandra-medusa | 0.29.1-r1 |
| openSUSE Leap 16.0 | python-aiohttp | 3.11.16-160000.7.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 |