CVE-2026-69243
AIOHTTP server vulnerable to request smuggling via WebSocket upgrades.
- CVSS 6.3
- 444
- Input Validation and Sanitization
- Remote
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
- CWE
- 444
- CVSS base score
- 6.3
- Published
- 2026-08-03
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Timing/Serialization
- Code defect classification
- Timing Issues
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Affected component
- AIOHTTP
- Fixed by upgrading
- Yes
Solution
Upgrade AIOHTTP to version 3.14.2 or later.
Vulnerable code sample
from typing import Any, List, Optional, Tuple
from aiohttp.http_exceptions import HttpBadRequest, HttpUpgrade
# A mock message object to represent an HTTP request.
class _MockMessage:
content_length: Optional[int] = 128
# Simplified representation of aiohttp's HttpRequestParser
class HttpRequestParser:
def __init__(self) -> None:
# A request message is built during parsing.
# We simulate a message with a body for a WebSocket upgrade request.
self._message: Optional[_MockMessage] = _MockMessage()
def feed_data(self, data: bytes) -> Tuple[List[Any], bool, bytes]:
try:
# This simulates a low-level parser raising HttpUpgrade
# when a WebSocket handshake is detected.
raise HttpUpgrade(payload=data)
except HttpUpgrade as exc:
# VULNERABLE: The protocol is upgraded before the request body is consumed,
# allowing trailing body bytes to be smuggled.
return [self._message], True, exc.payload
return [], False, b""Patched code sample
from typing import Any, List, Optional, Tuple
from aiohttp.http_exceptions import HttpBadRequest, HttpUpgrade
# A mock message object to represent an HTTP request.
class _MockMessage:
content_length: Optional[int] = 128
# Simplified representation of aiohttp's HttpRequestParser
class HttpRequestParser:
def __init__(self) -> None:
# A request message is built during parsing.
# We simulate a message with a body for a WebSocket upgrade request.
self._message: Optional[_MockMessage] = _MockMessage()
def feed_data(self, data: bytes) -> Tuple[List[Any], bool, bytes]:
try:
# This simulates a low-level parser raising HttpUpgrade
# when a WebSocket handshake is detected.
raise HttpUpgrade(payload=data)
except HttpUpgrade as exc:
# FIX: Reject WebSocket upgrade requests that contain a body.
if (
self._message is not None
and self._message.content_length is not None
and self._message.content_length > 0
):
raise HttpBadRequest("WebSocket upgrade request with body") from exc
return [self._message], True, exc.payload
return [], False, b""Payload
GET /ws-endpoint HTTP/1.1
Host: vulnerable-server.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
Content-Length: 52
GET /admin HTTP/1.1
Host: vulnerable-server.com
Cite this entry
@misc{vaitp:cve202669243,
title = {{AIOHTTP server vulnerable to request smuggling via WebSocket upgrades.}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2026},
note = {VAITP Python Vulnerability Dataset, entry CVE-2026-69243},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-69243/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
