CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade
Summary
CVE-2026-69243: AIOHTTP: HTTP request smuggling via WebSocket upgrade. Affects aiohttp versions < 3.14.2. Fixed in 3.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle both client-side and server-side HTTP requests. It supports WebSocket connections, allowing for real-time communication between clients and servers. However, a vulnerability has been identified in its HTTP parsers, specifically related to the WebSocket upgrade process, which could lead to request smuggling attacks.
Vulnerability Detail
The vulnerability arises from an edge case in the WebSocket upgrade procedure within AIOHTTP's HTTP parsers. An attacker could exploit this flaw to perform request smuggling, potentially allowing them to bypass security controls, manipulate requests, or inject malicious payloads. This could lead to unauthorized access or data breaches, although no public exploit code has been reported at this time.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.2
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional request validation or using a reverse proxy that can help filter and manage WebSocket connections until the package can be updated.
Conclusion
In summary, CVE-2026-69243 is a significant vulnerability in the AIOHTTP package that can lead to request smuggling attacks via WebSocket upgrades. It is crucial to update to the patched version to mitigate potential risks and ensure the security of your applications.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2026-69243 is a vulnerability in the AIOHTTP package that allows for HTTP request smuggling via WebSocket upgrades.
If your application uses AIOHTTP for handling WebSocket connections, it may be susceptible to request smuggling attacks, which could compromise security.
Yes, a patch has been released in version 3.14.2 of AIOHTTP. It is recommended to update to this version or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. You can check your application against this vulnerability using the Vulert playground without needing to sign up.
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
