CVE-2026-69244 json
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
published 2026-08-03 3 mo ago modified 2026-10-23 16 d ago also GHSA-cq5v-8q36-5273 , PYSEC-2026-3545 , EUVD-2026-52438
- cvss
- 7.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Patch / fix
- pypi aiohttp 3.14.3
- python-aiohttp Debian 14 3.14.3-1
debian advisories DEBIAN-CVE-2026-69244
- rubygem-jwt satellite utils 6.19, satellite utils 6.18, satellite utils 6.17 +9 more 2.10.3-1.el9sat
- ansible-core satellite maintenance 6.19, satellite maintenance 6.18, satellite maintenance 6.17 +6 more 1:2.16.19-1.el9sat
- ansible-test satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 1:2.16.19-1.el9sat
- openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.15.2-1.el9sat
- python-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
- python3.11-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
- python3.12-aiohttp satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 3.14.3-1.el9pc
- python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc
red hat advisories RHSA-2026:63387RHSA-2026:63385RHSA-2026:63386RHSA-2026:63327RHSA-2026:59135RHSA-2026:59136
- python-aiohttp SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP4 3.9.3-150400.10.46.1
- python-aiohttp SLES for SAP applications 16.0, SLES 16.0 3.11.16-160000.7.1
suse advisories SUSE-SU-2026:4031-1SUSE-SU-2026:23571-1
- python-aiohttp openSUSE Leap 16.0 3.11.16-160000.7.1
- python-aiohttp openSUSE Tumbleweed 3.14.3-1.1
opensuse advisories openSUSE-SU-2026:21687-1openSUSE-SU-2026:11467-1
- github.com/aio-libs/aiohttp@49f65d5 commit
- github.com/aio-libs/aiohttp#13223 pull request
- github.com/aio-libs/aiohttp/releases/tag/v3.14.3 release
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-69244 updated cvss 7.5
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
-
Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9affected: workaround, no fix available
-
Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaii/vllm-neuron-rhel9, rhaiis/vllm-neuron-rhel9, +1 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/de-minimal-rhel8, ansible-automation-platform-25/de-minimal-rhel9, ansible-automation-platform-26/de-minimal-rhel9, +11 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift AI (RHOAI) rhai/guidellm-rhel9, rhoai/odh-mlflow-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more Red Hat Satellite 6 python-aiohttp, python3-aiohttpaffected: workaround, no fix available
-
Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp 3.9.5-1.el9apaffected: workaround, no fix planned “Will not fix”
-
Red Hat Update Infrastructure 5 rhui5/rhua-rhel9, rhui5/rhua-tp-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1790621714fixed: vendor fix RHSA-2026:73859
-
Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287fixed: vendor fix RHSA-2026:68696
show 22 moreshow fewer
-
Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1790109620, rhaii/vllm-spyre-rhel9 1790076141fixed: vendor fix RHSA-2026:70965
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1787101922, ansible-automation-platform-25/controller-rhel8 1787171942, ansible-automation-platform-25/lightspeed-rhel8 1787229385fixed: vendor fix RHSA-2026:59159
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-aiohttp 3.14.3-1.el8ap, automation-controller-venv-tower 4.6.32-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9ap, automation-controller-venv-tower 4.6.32-1.el9apfixed: vendor fix RHSA-2026:59135
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1787220598, ansible-automation-platform-26/controller-rhel9 1789673739, ansible-automation-platform-26/lightspeed-rhel9 1787244079, ansible-automation-platform-26/ee-supported-rhel9 1787217357fixed: vendor fix RHSA-2026:71179
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9ap, automation-controller-venv-tower 4.7.16-1.el9apfixed: vendor fix RHSA-2026:59136
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/controller-rhel9 1788918363, ansible-automation-platform-27/ee-minimal-rhel9 1787217391, ansible-automation-platform-27/lightspeed-rhel9 1787217531, ansible-automation-platform-27/ee-supported-rhel9 1787235693fixed: vendor fix RHSA-2026:67279
-
Red Hat Ansible Automation Platform 2.18 ansible-automation-platform/ee-minimal-rhel8 1786971288, ansible-automation-platform/ee-minimal-rhel9 1786942232fixed: vendor fix RHSA-2026:55853
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1786638573fixed: vendor fix RHSA-2026:54760
-
Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 morefixed: vendor fix RHSA-2026:76041
-
Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120, +1 morefixed: vendor fix RHSA-2026:76150
-
Red Hat OpenShift AI 2.25 rhoai/odh-ta-lmes-job-rhel9 1787330903, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-caikit-tgis-serving-rhel9 1787060100, rhoai/odh-kserve-storage-initializer-rhel9 1791257289, rhoai/odh-training-rocm62-torch24-py311-rhel9 1788178712, rhoai/odh-training-rocm62-torch25-py311-rhel9 1788178637, +20 morefixed: vendor fix RHSA-2026:65126
-
Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1789121365, rhoai/odh-llama-stack-core-rhel9 1789121286, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1789570674fixed: vendor fix RHSA-2026:73987
-
Red Hat OpenShift AI 3.4 rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-mlserver-rhel9 1791446063, rhoai/odh-ta-lmes-job-rhel9 1791470318, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-llama-stack-core-rhel9 1790958470, rhoai/odh-kserve-autogluon-server-rhel9 1791300023, +31 morefixed: vendor fix RHSA-2026:84734
-
Red Hat OpenShift AI 3.5 rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlserver-rhel9 1789532398, rhoai/odh-ta-lmes-job-rhel9 1788935863, rhoai/odh-mlserver-cuda-rhel9 1789529984, rhoai/odh-th-torch-cpu-py312-rhel9 1789702699, rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, +29 morefixed: vendor fix RHSA-2026:86891
-
Red Hat Satellite 6.16 for RHEL 8 python-aiohttp 3.14.3-1.el8pc, python3.11-aiohttp 3.14.3-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63327
-
Red Hat Satellite 6.17 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat, python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63387
-
Red Hat Satellite 6.18 satellite/iop-insights-engine-rhel9 1789260306, satellite/iop-vulnerability-engine-rhel9 1788190382fixed: vendor fix RHSA-2026:68770
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc, python3.12-pulpcore 3.73.30-3.el9pc, pulpcore-obsolete-packages 1.3.1-5.el9pcfixed: vendor fix RHSA-2026:63386
-
Red Hat Satellite 6.19 satellite/iop-insights-engine-rhel9 1789273626, satellite/iop-vulnerability-engine-rhel9 1788190224fixed: vendor fix RHSA-2026:68775
-
Red Hat Satellite 6.19 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pcfixed: vendor fix RHSA-2026:63385
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9not affected: vulnerable code cannot be controlled by adversary
-
Red Hat Ansible Automation Platform 2 python-aiohttp 3.9.5-1.el9ap, python3x-aiohttp 3.9.5-1.el8ap, python3.11-aiohttp 3.9.5-1.el9ap, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-24/de-supported-rhel9, +5 more Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/gateway-rhel8 1787100608, ansible-automation-platform-25/hub-web-rhel8 1787185021, ansible-automation-platform-25/receptor-rhel8 1787100120, ansible-automation-platform-25/de-minimal-rhel8 1787223460, ansible-automation-platform-25/ee-minimal-rhel8 1787218259, ansible-automation-platform-25/de-supported-rhel8 1787225360, +18 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-hub 4.10.18-1.el8ap, python3.12-django 5.2.17-1.el8ap, python3.12-gitpython 3.1.59-1.el8ap, automation-controller 4.6.32-1.el8ap, python3.12-galaxy-ng 4.10.18-1.el8ap, automation-controller-ui 4.6.32-1.el8ap, +10 morenot affected: vulnerable code not present
18 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | aiohttp | <3.14.3 |
3.14.3 |
Affected products
- aio-libs aiohttp
Classification
References
-
github.com
/aio-libs/aiohttp/pull/13223
web
-
github.com
/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
web
-
github.com
/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273
web
-
github.com
/aio-libs/aiohttp/releases/tag/v3.14.3
web
-
github.com
/aio-libs/aiohttp
package
-
pypi.org
/project/aiohttp
package
-
github.com
/advisories/GHSA-cq5v-8q36-5273
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-69244
advisory
Sources
- CVE List CVE-2026-69244
- GitHub Advisory GHSA-cq5v-8q36-5273
- NVD CVE-2026-69244
- OSV PYSEC-2026-3545
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.