GitHub Advisoryadvisory · PyPI

GHSA-cq5v-8q36-5273 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

HIGH Published 2026-08-03 Modified 2026-08-03 Official page ↗
Aliases
CVE-2026-69244
Ecosystem
PyPI
Packages
aiohttp
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-125, CWE-400, CWE-416
Reviewed
2026-08-03

Affected packages

• PyPI aiohttp: < 3.14.3 → fixed in 3.14.3

Description

Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`. --- Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d

Related

Alias · CVE (1)

  • CVE-2026-69244 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (3)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-416 Use After Free weakness

References