NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

CVE-2026-69244 — aiohttp

Fix: aio-libs/aiohttp@49f65d5

CVE-2026-69244 is a Out-of-bounds Read vulnerability in aiohttp. A fix is available for aiohttp — see the affected versions and patch details below.

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Also known asGHSA-cq5v-8q36-5273PYSEC-2026-3545
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 31, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-69244.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk
0.00%0.34%0.69%1.03%0.3%0.5%0.5%Sep 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐍aiohttp

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIaiohttpall versions3.14.3pip install --upgrade 'aiohttp==3.14.3'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for aiohttp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update aiohttp to 3.14.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-69244 is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is an Important severity flaw in aiohttp that could lead to a denial of service in client applications. A remote, malicious HTTP server could send a specially crafted response, causing an out-of-bounds read in the aiohttp C response parser and resulting in the client application terminating unexpectedly.

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Source: Red Hat security advisory for CVE-2026-69244 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ansible Automation Platform 2.5 for RHEL 8automation-controller-0:4.6.32-1.el8apRHSA-2026:59135
Red Hat Ansible Automation Platform 2.6 for RHEL 9automation-controller-0:4.7.16-1.el9apRHSA-2026:59136
Red Hat Satellite 6.16 for RHEL 8python-aiohttp-0:3.14.3-1.el8pcRHSA-2026:63327
Red Hat Satellite 6.17 for RHEL 9ansible-core-1:2.16.19-1.el9satRHSA-2026:63387
Red Hat Satellite 6.18 for RHEL 9pulpcore-obsolete-packages-0:1.3.1-5.el9pcRHSA-2026:63386
Red Hat Satellite 6.19 for RHEL 9python3.12-aiohttp-0:3.14.3-1.el9pcRHSA-2026:63385
Red Hat AI Inference Server 3.2rhaiis/model-opt-cuda-rhel9:1790621714RHSA-2026:73859
Red Hat AI Inference Server 3.2rhaiis/vllm-cuda-rhel9:1790621718RHSA-2026:73929

Frequently Asked Questions

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
O3 Security · Impact-Aware SCA

Is CVE-2026-69244 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-69244: aiohttp DoS — Fixed in 3.14.3