Most recent entries from all

fkie_cve-2026-111750

2026-10-21T10:56:17.711627+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

GHSA-pqxq-w44r-73xw — AIOHTTP: Pure-Python parser request smuggling

2026-10-21T10:56:17.711720+00:00

Affected: PyPI: aiohttp

### Summary

The pure Python parser is vulnerable to an HTTP request smuggling attack.

### Impact

If users are using the Python parser (`AIOHTTP_NO_EXTENSIONS`, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.

### Workaround

Switch to the default C parser.