Is CVE-2026-111750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111750 being exploited in the wild.

How severe is CVE-2026-111750?

Medium severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

Is there a fix for CVE-2026-111750?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111750?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111750: aiohttp HTTP request smuggling in pure Python parser

Q: Is there a fix for CVE-2026-111750?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-111750 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-111750?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111750 · Severity: medium · CVSS 4 · Published 2026-10-19

aiohttp is an asynchronous HTTP client/server framework for Python. The pure Python HTTP parser prior to version 3.14.4 accepts ambiguous request framing, allowing an attacker to smuggle HTTP requests when intermediaries interpret the framing differently. This can lead to request misrouting and potential security bypass when the standard compiled extension is not used.

Technologies: Aio-Libs Aiohttp, aiohttp (PyPI). Vendors: Aio-Libs, PyPI.

Quick answers

Is CVE-2026-111750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111750 being exploited in the wild.
How severe is CVE-2026-111750?: Medium severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.
Is there a fix for CVE-2026-111750?: Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111750?: Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.14.4 or later
```
pip install "aiohttp>=3.14.4"
```

Technical details

The pure Python HTTP parser in aiohttp accepts ambiguous HTTP request framing that should be rejected according to HTTP specifications. An unauthenticated remote attacker can craft malformed requests that are interpreted differently by aiohttp and upstream proxies or load balancers, enabling HTTP request smuggling. This issue does not affect the standard C-based parser that comes with compiled wheels; it only manifests when AIOHTTP_NO_EXTENSIONS is set or when running without wheel installations.

Affected products

aio-libs aiohttp before 3.14.4

Identifiers

CVE-2026-111750
GHSA-pqxq-w44r-73xw

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.