CVE-2026-69244 Details
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
A denial-of-service vulnerability has been identified in AIOHTTP, an asynchronous HTTP client/server framework for Python. This issue affects versions of AIOHTTP through 3.14.2. The vulnerability arises from an out-of-bounds heap read in the C response parser, which can occur while constructing an error message for a malformed response. An attacker-controlled server or an accidental response could exploit this vulnerability, causing a denial-of-service condition in the client.
Users can upgrade to AIOHTTP version 3.14.3, which addresses the vulnerability. If an upgrade is not possible, the Python parser can be used as a workaround, as it is not affected by this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-416 | Use After Free | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |