CVE-2026-111750: AIOHTTP: Pure-Python parser request smuggling

Q: Which deployments are exposed to this issue?

Deployments using AIOHTTP before version 3.14.4 are exposed when they use the pure-Python parser, such as when AIOHTTP_NO_EXTENSIONS is set or when AIOHTTP runs without a standard wheel. Exploitation additionally depends on an intermediary interpreting HTTP request framing differently.

Q: Does exploitation require authentication or user interaction?

No. The issue can be exploited by an unauthenticated attacker and does not require user interaction.

Q: What is the remediation?

Upgrade AIOHTTP to version 3.14.4, which fixes the ambiguous request-framing handling in the pure-Python parser.

Published Oct 19, 2026

Updated

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

Affected Software

1 affected component

pypi/aiohttp<3.14.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade aiohttp to a version that resolves this vulnerability.
Fixed in 3.14.4

Event History

Oct 19, 2026

CVE Published

via MITRE·05:06 PM

Data Sourced

via MITRE·05:06 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using AIOHTTP before version 3.14.4 are exposed when they use the pure-Python parser, such as when AIOHTTP_NO_EXTENSIONS is set or when AIOHTTP runs without a standard wheel. Exploitation additionally depends on an intermediary interpreting HTTP request framing differently.

Does exploitation require authentication or user interaction?