Read the docs
TI-2026-48583 Aliases CVE-2026-69244GHSA-cq5v-8q36-5273

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Priority LOW 32CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 24 fixed, 12 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Partial aiohttp (aio-libs): 3.14.3aiohttp (PyPI): 3.14.3Red Hat: 40 advisoriesRed Hat: 24 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aio-libsaiohttpbefore 3.14.33.14.3Patch availableCNA
—aiohttp (PyPI)before 3.14.33.14.3Patch availableGHSA-cq5v-8q36-5273
  • aiohttp Vendoraio-libs Affected before 3.14.3 Fixed in 3.14.3 Patch available CNA
  • aiohttp (PyPI) Vendor— Affected before 3.14.3 Fixed in 3.14.3 Patch available GHSA-cq5v-8q36-5273

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*——Aiohttp
  • cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions — — ·Aiohttp

Remediation

  • Fix · CNA aiohttp (aio-libs) Fixed in 3.14.3
  • Fix · GHSA-cq5v-8q36-5273 aiohttp (PyPI) Fixed in 3.14.3 Advisory →

Red Hat 40 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 37 more Red Hat advisories
  • RHSA-2026:76150 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:76149 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76043 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76041 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:73859 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
  • RHSA-2026:70995 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:70969 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69539 Released 2026-09-21 · Red Hat rating Important
    RHOAI 3.5.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +28
  • RHSA-2026:68775 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:68770 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:68699 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:68698 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:68697 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:68696 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:67279 Released 2026-09-14 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63327 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.16.13 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-server-8.15.2-1.el8sat, python-aiohttp-3.14.3-1.el8pc, python3.11-aiohttp-3.14.3-1.el8pc +1
    • Red Hat Satellite 6.16 for RHEL 9 openvox-server-8.15.2-1.el9sat, python-aiohttp-3.14.3-1.el9pc, python3.11-aiohttp-3.14.3-1.el9pc +1
  • RHSA-2026:63385 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.19.4 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63387 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.17.11 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63386 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.18.9 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +4
  • RHSA-2026:63337 Released 2026-09-03 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:63334 Released 2026-09-03 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59159 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:59155 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
  • RHSA-2026:59153 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
  • RHSA-2026:59136 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-django-5.2.17-1.el10ap, python3-django-5.2.17-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-cli-4.7.16-1.el9ap, automation-controller-venv-tower-4.7.16-1.el9ap, automation-platform-ui-2.6.13-1.el9ap +3
  • RHSA-2026:59135 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-cli-4.6.32-1.el8ap, automation-controller-venv-tower-4.6.32-1.el8ap, automation-gateway-server-2.5.20260824-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-cli-4.6.32-1.el9ap, automation-controller-venv-tower-4.6.32-1.el9ap, automation-gateway-server-2.5.20260824-1.el9ap +3
  • RHSA-2026:55853 Released 2026-08-17 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
  • RHSA-2026:55852 Released 2026-08-17 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel9
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Will not fix
Red Hat Update Infrastructure 5AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73859, RHSA-2026:73929, RHSA-2026:73930
Red Hat AI Inference Server 3.3Fixed RHSA-2026:68696, RHSA-2026:68697, RHSA-2026:68698, RHSA-2026:68699
Red Hat AI Inference Server 3.4Fixed RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995
Red Hat Ansible Automation Platform 2.18Fixed RHSA-2026:55852, RHSA-2026:55853
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:59159
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:59155, RHSA-2026:71179
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:59136
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:59153, RHSA-2026:67279
Red Hat Discovery 2Fixed RHSA-2026:54760
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:76041, RHSA-2026:76043
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:76149, RHSA-2026:76150
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126, RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:69539, RHSA-2026:86891
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:63327
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:63327
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:63387
Red Hat Satellite 6.18Fixed RHSA-2026:63334, RHSA-2026:68770
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:63386
Red Hat Satellite 6.19Fixed RHSA-2026:63337, RHSA-2026:68775
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:63385
Not affected: 22 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Discovery 2
  • Red Hat Hardened Images
  • Red Hat Lightspeed Services for OCP
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69244
  2. 2026-10-03 Alias added: GHSA-cq5v-8q36-5273
  3. 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
  5. 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
  6. 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
  7. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux AI 3.4 · Red Hat
  8. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  9. 2026-10-07 Affected versions changed · Red Hat
  10. 2026-10-09 Affected versions changed · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Affected versions changed · Red Hat
  13. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  14. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  15. 2026-10-23 Affected versions changed · Red Hat

References

Other 5

  • TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
  • TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
  • TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
  • TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
  • TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
  • TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences