Quick answers
- Is CVE-2026-69244 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-69244 being exploited in the wild.
- How severe is CVE-2026-69244?
- High severity, with a CVSS score of 4, published 3 August 2026.
- Which products and versions are affected?
- aiohttp (PyPI) <= 3.14.2, ECOSYSTEM:introduced=0,fixed=3.14.3.
- Is there a fix for CVE-2026-69244?
- Yes. aiohttp (PyPI): upgrade to 3.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-69244 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-69244?
- Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- aiohttp (PyPI): upgrade to 3.14.3 or later
pip install "aiohttp>=3.14.3"
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in the C-based HTTP response parser of AIOHTTP. The flaw is triggered during the construction of an error message when the parser encounters a malformed chunked response. A remote attacker controlling a web server can exploit this by sending a crafted response to an AIOHTTP client, leading to a process crash (Denial of Service). The vulnerability is present in versions up to and including 3.14.2 and is fixed in version 3.14.3. A workaround is available by disabling the C extensions using the environment variable AIOHTTP_NO_EXTENSIONS=1, which forces the use of the unaffected Python-based parser.
Affected products
- aio-libs aiohttp <= 3.14.2
Identifiers
- CVE-2026-69244
- GHSA-cq5v-8q36-5273
- PYSEC-2026-3545
Timeline
- 2026-07-25: disclosed: Initial report to aio-libs/aiohttp
- 2026-08-03: advisory: GitHub Advisory published