CVE-2026-69243: AIOHTTP Request Smuggling Vulnerability

CVE-2026-69243 Overview

CVE-2026-69243 is an HTTP request smuggling vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python's asyncio. The flaw affects versions prior to 3.14.2 and is tracked under CWE-444: Inconsistent Interpretation of HTTP Requests. The server-side HTTP parser mishandles WebSocket upgrade requests that include a body, switching protocols before the full body is consumed. Trailing bytes are then interpreted as upgraded-protocol frames or pipelined HTTP requests. The maintainers released a fix in aiohttp 3.14.2.

Critical Impact
An attacker can smuggle a second HTTP request behind a crafted WebSocket upgrade, potentially bypassing front-end security controls and poisoning downstream request processing.

Affected Products

aiohttp server-side component, all versions prior to 3.14.2
Python applications embedding aiohttp as their HTTP server
Reverse-proxied deployments where aiohttp serves as an upstream WebSocket endpoint

Discovery Timeline

2026-08-03 - CVE-2026-69243 published to NVD
2026-08-05 - Last updated in NVD database
v3.14.2 - aiohttp maintainers release patched version via GitHub Release v3.14.2 and GHSA-mfx4-hv73-q22v

Technical Details for CVE-2026-69243

Vulnerability Analysis

The vulnerability sits in the aiohttp C-accelerated HTTP parser (aiohttp/_http_parser.pyx). When a client sends a WebSocket upgrade request that also carries an HTTP request body, the parser flips the connection into upgraded state immediately upon seeing the upgrade headers. Any remaining bytes of the original body are no longer treated as HTTP body content. Instead, those bytes are surfaced to the application either as inbound WebSocket frames or as a fresh pipelined HTTP request on the same connection. This mismatch between how a front-end proxy and the aiohttp back-end interpret the same byte stream is the defining property of an HTTP Request Smuggling class flaw.

Root Cause

The parser did not distinguish between an in-progress upgrade and a completed upgrade. It set the _upgraded state before verifying that the declared request body had been fully consumed. The 3.14.2 fix introduces a new _pending_upgrade state that defers the protocol switch until the request body read completes.

Attack Vector

An unauthenticated network attacker crafts a GET request with Upgrade: websocket headers plus a Content-Length or chunked body. A fronting proxy forwards the full request; aiohttp then treats the trailing body bytes as either the first WebSocket frame or a smuggled follow-on HTTP request. This can be used to bypass proxy-level authorization, poison shared caches, or hijack another user's response on a reused connection.

text

         set     _seen_singletons
         list    _raw_headers
         bint    _upgraded
+        bint    _pending_upgrade
         list    _messages
         bint    _more_data_available
         bint    _paused

Source: aiohttp commit 6ae358f. The patch adds a _pending_upgrade flag so body reads complete before the parser hands the socket off to the upgraded protocol.

Detection Methods for CVE-2026-69243

Indicators of Compromise

WebSocket upgrade requests that also declare Content-Length greater than 0 or Transfer-Encoding: chunked.
Unexpected HTTP request lines appearing inside inbound WebSocket frames on aiohttp handlers.
Access logs showing paired requests on a single connection where the second request has no matching client-side origin.
Front-end proxy logs whose byte counts do not match aiohttp back-end request byte counts for the same connection.

Detection Strategies

Inspect HTTP traffic for Upgrade: websocket combined with a non-zero request body length; RFC-conformant WebSocket handshakes do not include a body.
Deploy WAF or reverse-proxy rules that reject upgrade requests carrying Content-Length or Transfer-Encoding headers.
Correlate application logs against upstream proxy logs to surface request-count or byte-count divergences per connection.

Monitoring Recommendations

Track the deployed aiohttp version across services and alert on any release below 3.14.2.
Instrument WebSocket endpoints to log the first inbound frame's opcode and size; smuggled HTTP verbs will appear as text frames beginning with GET, POST, or similar tokens.
Enable connection-level metrics on fronting proxies to flag connections carrying more parsed requests than the back-end acknowledges.

How to Mitigate CVE-2026-69243

Immediate Actions Required

Upgrade aiohttp to version 3.14.2 or later across all Python services running the server-side component.
Audit dependency manifests (requirements.txt, pyproject.toml, poetry.lock) and container images for pinned versions below 3.14.2.
Restart long-running aiohttp processes after the upgrade so cached parser state is discarded.

Patch Information

The fix landed in aiohttp 3.14.2. Review the GitHub Security Advisory GHSA-mfx4-hv73-q22v, the pull request discussion, and the remediation commit for implementation detail. The patch introduces a _pending_upgrade parser flag so body reads complete before the connection transitions to the upgraded protocol.

Workarounds

Configure the fronting proxy or WAF to drop any Upgrade: websocket request that also contains Content-Length greater than 0 or Transfer-Encoding: chunked.
Disable HTTP/1.1 connection keep-alive between the proxy and aiohttp back-end so smuggled follow-on requests cannot ride a reused connection.
Terminate WebSocket traffic at a hardened proxy that normalizes the upgrade handshake before forwarding to aiohttp.

bash

# Upgrade aiohttp to the fixed release
pip install --upgrade 'aiohttp>=3.14.2'

# Verify the installed version
python -c "import aiohttp; print(aiohttp.__version__)"