CVE-2026-69244 in aiohttp
Summary
by MITRE • 08/04/2026
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The aiohttp library represents a critical asynchronous HTTP client/server framework built on asyncio and Python, widely adopted across enterprise applications and microservices architectures for handling concurrent network operations. This vulnerability specifically targets the C-based response parser component within the library's internal implementation, highlighting a fundamental security flaw that could severely impact system availability. The issue manifests as an out-of-bounds heap read condition during error message construction, occurring when processing malformed HTTP responses from servers under attacker control or accidental malformed responses from legitimate sources.
The technical flaw exists within the aiohttp/_http_parser.pyx file where llhttp error-position pointers are utilized to construct diagnostic snippets for malformed chunked responses and malformed request or response bytes located at buffer boundaries. This particular implementation vulnerability stems from improper bounds checking when accessing memory locations that correspond to error positions reported by the underlying llhttp parser library. The heap read operation attempts to access memory beyond allocated buffer limits, creating an exploitable condition where an attacker could craft malicious HTTP responses to trigger this behavior during normal client operation.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions, as it represents a potential vector for remote code execution or system compromise when exploited in conjunction with other attack vectors. The vulnerability affects all versions prior to 3.14.3 and could be triggered by any legitimate HTTP client using aiohttp to process responses from untrusted sources. This makes the flaw particularly dangerous in environments where clients interact with external services, APIs, or potentially malicious actors who could craft specific malformed responses designed to exploit this precise memory access pattern.
The fix implemented in version 3.14.3 addresses this vulnerability through proper bounds checking of error-position pointers before constructing diagnostic message snippets. This remediation aligns with established security practices for preventing out-of-bounds memory accesses and follows the CWE-125 principle of ensuring memory safety during buffer operations. Organizations should prioritize immediate patching of affected systems, as this vulnerability could enable attackers to cause service disruption or potentially escalate privileges depending on system configurations. The issue maps to ATT&CK technique T1499.004 for network denial-of-service attacks and demonstrates the critical importance of validating external input in asynchronous HTTP processing frameworks.