Read the docs
TI-2026-48582 Aliases CVE-2026-69243GHSA-mfx4-hv73-q22v

AIOHTTP: HTTP request smuggling via WebSocket upgrade

Priority LOW 28CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 22 fixed, 12 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Partial aiohttp (aio-libs): 3.14.2aiohttp (PyPI): 3.14.2Red Hat: 38 advisoriesRed Hat: 22 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aio-libsaiohttpbefore 3.14.23.14.2Patch availableCNA
—aiohttp (PyPI)before 3.14.23.14.2Patch availableGHSA-mfx4-hv73-q22v
  • aiohttp Vendoraio-libs Affected before 3.14.2 Fixed in 3.14.2 Patch available CNA
  • aiohttp (PyPI) Vendor— Affected before 3.14.2 Fixed in 3.14.2 Patch available GHSA-mfx4-hv73-q22v

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*——Aiohttp
  • cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions — — ·Aiohttp

Remediation

  • Fix · CNA aiohttp (aio-libs) Fixed in 3.14.2
  • Fix · GHSA-mfx4-hv73-q22v aiohttp (PyPI) Fixed in 3.14.2 Advisory →

Red Hat 38 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:87120 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 35 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:79378 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
  • RHSA-2026:76150 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:76149 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76043 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76041 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:73859 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:70995 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:70969 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69539 Released 2026-09-21 · Red Hat rating Important
    RHOAI 3.5.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +28
  • RHSA-2026:68775 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:68770 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:68699 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:68698 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:68697 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:68696 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:67279 Released 2026-09-14 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63327 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.16.13 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-server-8.15.2-1.el8sat, python-aiohttp-3.14.3-1.el8pc, python3.11-aiohttp-3.14.3-1.el8pc +1
    • Red Hat Satellite 6.16 for RHEL 9 openvox-server-8.15.2-1.el9sat, python-aiohttp-3.14.3-1.el9pc, python3.11-aiohttp-3.14.3-1.el9pc +1
  • RHSA-2026:63385 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.19.4 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63387 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.17.11 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63386 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.18.9 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +4
  • RHSA-2026:63337 Released 2026-09-03 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:63334 Released 2026-09-03 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59155 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
  • RHSA-2026:59153 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
  • RHSA-2026:59136 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-django-5.2.17-1.el10ap, python3-django-5.2.17-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-cli-4.7.16-1.el9ap, automation-controller-venv-tower-4.7.16-1.el9ap, automation-platform-ui-2.6.13-1.el9ap +3
  • RHSA-2026:59135 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-cli-4.6.32-1.el8ap, automation-controller-venv-tower-4.6.32-1.el8ap, automation-gateway-server-2.5.20260824-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-cli-4.6.32-1.el9ap, automation-controller-venv-tower-4.6.32-1.el9ap, automation-gateway-server-2.5.20260824-1.el9ap +3
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Out of support scope
Red Hat Update Infrastructure 5AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73859, RHSA-2026:73929, RHSA-2026:73930
Red Hat AI Inference Server 3.3Fixed RHSA-2026:68696, RHSA-2026:68697, RHSA-2026:68698, RHSA-2026:68699
Red Hat AI Inference Server 3.4Fixed RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:59155, RHSA-2026:87120
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:59136
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:59153, RHSA-2026:67279, RHSA-2026:79378
Red Hat Discovery 2Fixed RHSA-2026:54760
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:76041, RHSA-2026:76043
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:76149, RHSA-2026:76150
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126, RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:69539, RHSA-2026:86891
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:63327
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:63327
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:63387
Red Hat Satellite 6.18Fixed RHSA-2026:63334, RHSA-2026:68770
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:63386
Red Hat Satellite 6.19Fixed RHSA-2026:63337, RHSA-2026:68775
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:63385
Not affected: 21 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Discovery 2
  • Red Hat Hardened Images
  • Red Hat Lightspeed Services for OCP
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69243
  2. 2026-10-03 Alias added: GHSA-mfx4-hv73-q22v
  3. 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
  5. 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
  6. 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
  7. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux AI 3.4 · Red Hat
  8. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  9. 2026-10-07 Affected versions changed · Red Hat
  10. 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
  11. 2026-10-09 Affected versions changed · Red Hat
  12. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  13. 2026-10-20 Affected versions changed · Red Hat
  14. 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
  15. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  16. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  17. 2026-10-23 Affected versions changed · Red Hat

References

Other 5

  • TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
  • TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
  • TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
  • TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
  • TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
  • TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences