CVE-2026-69244: AIOHTTP out-of-bounds heap read in C HTTP response parser

Executive brief

AIOHTTP is a popular Python library used for handling web requests. A vulnerability in its C-based response parser could allow a malicious server to crash applications using the library by sending a specially crafted, malformed response. This results in a denial-of-service (DoS) condition, potentially disrupting services that rely on AIOHTTP to fetch data.

Technical details

An out-of-bounds (OOB) heap read vulnerability exists in the C-based HTTP response parser of AIOHTTP. The flaw is triggered during the construction of an error message when the parser encounters a malformed chunked response. A remote attacker controlling a web server can exploit this by sending a crafted response to an AIOHTTP client, leading to a process crash (Denial of Service). The vulnerability is present in versions up to and including 3.14.2 and is fixed in version 3.14.3. A workaround is available by disabling the C extensions using the environment variable AIOHTTP_NO_EXTENSIONS=1, which forces the use of the unaffected Python-based parser.

Affected products

• aio-libs aiohttp <= 3.14.2

Timeline

• 2026-07-25: disclosed: Initial report to aio-libs/aiohttp
• 2026-08-03: advisory: GitHub Advisory published

References

• https://api.github.com/users/agners
• https://github.com/agners
• https://api.github.com/users/agners/gists%7B/gist_id%7D
• https://api.github.com/users/agners/repos
• https://avatars.githubusercontent.com/u/34061?v=4
• https://api.github.com/users/agners/events%7B/privacy%7D