CVE-2026-111750: AIOHTTP Pure-Python Parser Request Smuggling Vulnerability
Summary
CVE-2026-111750: AIOHTTP: Pure-Python parser request smuggling. Affects aiohttp versions < 3.14.4. Fixed in 3.14.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle both client-side and server-side web applications. It provides a simple and efficient way to manage HTTP requests and responses, making it a go-to choice for developers building web applications. However, the pure Python parser used in AIOHTTP has been found to be vulnerable to an HTTP request smuggling attack, which can compromise the integrity of web applications that rely on this parser.
Vulnerability Detail
The vulnerability arises from the use of the pure Python parser in AIOHTTP, which is susceptible to HTTP request smuggling attacks. This type of attack allows an attacker to send crafted requests that can be interpreted differently by the server and intermediary devices, potentially leading to unauthorized actions or data exposure. The issue is particularly critical for applications that do not use the standard C parser, as they are left exposed to this attack vector. The vulnerability has been assigned a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.4
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can switch to the default C parser by ensuring that the environment variable AIOHTTP_NO_EXTENSIONS is not set, or by installing the standard wheel for AIOHTTP. This will help avoid the vulnerability until the package can be updated.
Conclusion
The AIOHTTP package has a vulnerability (CVE-2026-111750) related to its pure Python parser, which is susceptible to HTTP request smuggling attacks. Users are advised to update to version 3.14.4 or later to secure their applications. In the meantime, a workaround is available by switching to the default C parser.
See every vulnerability recorded for aiohttp →
FAQ
Request smuggling is a type of attack where an attacker sends multiple HTTP requests in a single connection, causing the server to misinterpret the requests and potentially execute unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data leakage, or manipulation of requests, which can severely impact the security and integrity of your web application.
Yes, the permanent fix is to update the AIOHTTP package to version 3.14.4 or later, which addresses the vulnerability.
If immediate updates are not possible, consider using the workaround by switching to the default C parser to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
