CVE-2026-69243: AIOHTTP request smuggling in WebSocket upgrade

Executive brief

AIOHTTP is a popular Python library used to build web servers and handle web requests. A vulnerability in how it handles WebSocket connections could allow an attacker to "smuggle" hidden requests past security filters. This could potentially allow unauthorized actions or bypass security controls on the server.

Technical details

AIOHTTP's server-side component contains a flaw in its HTTP parser related to the WebSocket upgrade procedure (CWE-444). An attacker can exploit an edge case during the handshake to smuggle a second HTTP request within what appears to be a single connection. This is a network-based attack with high complexity, as it requires specific timing or formatting to bypass the parser's logic. Successful exploitation could allow an attacker to bypass security proxies or perform unauthorized actions on the backend server. The issue is fixed in version 3.14.2.

Affected products

• aio-libs aiohttp <= 3.14.1

Timeline

• 2026-07-26: disclosed
• 2026-08-03: advisory
• 2026-08-03: patched: Version 3.14.2 released

References

• https://api.github.com/users/shivams0099
• https://github.com/shivams0099
• https://api.github.com/users/shivams0099/gists%7B/gist_id%7D
• https://api.github.com/users/shivams0099/repos
• https://avatars.githubusercontent.com/u/40691890?v=4
• https://api.github.com/users/shivams0099/events%7B/privacy%7D