CVE-2026-69244: AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTPNOEXTENSIONS=1.
---
Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/httpparser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3 - Upgrade
Upgrade
aio-libs/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3Patch 49f65d54150397892f7bcc4aae887767d51c322d - Configuration
If unable to upgrade to 3.14.3, set environment variable AIOHTTP_NO_EXTENSIONS=1 to use the Python parser instead of the C extensions (which are affected by the out-of-bounds heap read in the C response parser error path).
aiohttp C extensions AIOHTTP_NO_EXTENSIONS = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69244?
CVE-2026-69244 has a severity rating of high with a CVSS score of 7.1.
How do I fix CVE-2026-69244?
To fix CVE-2026-69244, upgrade to the latest version of aiohttp that addresses this vulnerability.
What type of impact does CVE-2026-69244 have?
CVE-2026-69244 could lead to a Denial of Service (DoS) in the client due to out-of-bounds heap read vulnerabilities.
Is CVE-2026-69244 related to a specific software?
CVE-2026-69244 is specifically related to the aiohttp software library.
What conditions can trigger CVE-2026-69244?
CVE-2026-69244 can be triggered by an attacker-controlled server or a malformed HTTP response.