CVE-2026-69244: AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTPNOEXTENSIONS=1.
---
Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/httpparser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3 - Upgrade
Upgrade
aio-libs/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3Patch 49f65d54150397892f7bcc4aae887767d51c322d - Configuration
If unable to upgrade to 3.14.3, set environment variable AIOHTTP_NO_EXTENSIONS=1 to use the Python parser instead of the C extensions (which are affected by the out-of-bounds heap read in the C response parser error path).
aiohttp C extensions AIOHTTP_NO_EXTENSIONS = 1