CVE-2026-69244: AIOHTTP DoS Vulnerability

CVE-2026-69244 Overview

CVE-2026-69244 is an out-of-bounds heap read vulnerability [CWE-125] in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. The flaw resides in the C response parser at aiohttp/_http_parser.pyx, where the error message construction path uses an llhttp error-position pointer to build a snippet from malformed chunked responses or malformed request/response bytes at the buffer end. An attacker-controlled server, or an accidentally malformed response, can trigger a denial of service in the client. The issue affects AIOHTTP versions prior to 3.14.3 and is fixed in 3.14.3.

Critical Impact
An attacker-controlled or malformed HTTP server response can cause AIOHTTP clients to read past heap buffer bounds, leading to a denial-of-service condition in the client process.

Affected Products

AIOHTTP versions prior to 3.14.3
Python applications using AIOHTTP's C-based HTTP response parser
Async HTTP clients built on the aiohttp/_http_parser.pyx code path

Discovery Timeline

2026-08-03 - CVE-2026-69244 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69244

Vulnerability Analysis

The vulnerability occurs during error message construction in AIOHTTP's C response parser. When the parser encounters a malformed chunked response or malformed bytes near the end of the receive buffer, it retrieves an error-position pointer from llhttp via cparser.llhttp_get_error_pos(self._cparser). The parser then subtracts a base pointer to compute an offset used to slice the buffer. Because the error-position pointer can reference a location beyond the bounded input data, the resulting slice operation reads past the intended heap allocation boundary. The read occurs in code that formats a diagnostic snippet, so any client connecting to a hostile or misbehaving server is exposed on parser errors.

Root Cause

The root cause is unbounded pointer arithmetic in the error-message construction path. The original code computed after = cparser.llhttp_get_error_pos(self._cparser) and then indexed data[:after - base], assuming the pointer arithmetic stayed within the data buffer. When llhttp returned a position at or beyond the buffer boundary for malformed input, the slice logic dereferenced memory outside the allocated region [CWE-125].

Attack Vector

Exploitation requires the AIOHTTP client to connect to an attacker-controlled or misbehaving HTTP server. The server returns a malformed chunked response, or malformed request/response bytes positioned at the buffer end, which triggers the error path in _http_parser.pyx. User interaction is required in the form of initiating the outbound HTTP request. Successful exploitation crashes the client process, producing a denial of service.

text

// Security patch in aiohttp/_http_parser.pyx (excerpt)
                     ex = self._last_error
                     self._last_error = None
                 else:
-                    after = cparser.llhttp_get_error_pos(self._cparser)
-                    before = data[:after - base]
-                    after_b = after.split(b"\r\n", 1)[0]
+                    error_pos = cparser.llhttp_get_error_pos(self._cparser)
+                    error_off = error_pos - base
+                    before = data[:error_off]
+                    after = data[error_off:].split(b"\r\n", 1)[0]
                     before = before.rsplit(b"\r\n", 1)[-1]
-                    data = before + after_b
+                    data = before + after
                     pointer = " " * (len(repr(before))-1) + "^"
                     ex = parser_error_from_errno(self._cparser, data, pointer)
                 self._payload = None

Source: aio-libs/aiohttp commit 49f65d5. The patch replaces the raw pointer split with a bounded offset into the data buffer, ensuring the snippet is constructed only from memory the parser owns.

Detection Methods for CVE-2026-69244

Indicators of Compromise

Repeated crashes or unhandled exceptions in Python processes using AIOHTTP client sessions when parsing responses from specific upstream hosts.
Traceback entries referencing aiohttp/_http_parser during response parsing of chunked or malformed HTTP replies.
Outbound connections to untrusted HTTP servers returning malformed chunked transfer-encoded payloads.

Detection Strategies

Inventory Python environments and container images to identify AIOHTTP versions below 3.14.3 using dependency scanning against requirements.txt, poetry.lock, and Pipfile.lock.
Monitor application logs for unexpected HttpProcessingError and parser-related exceptions correlated with specific remote endpoints.
Use network monitoring to flag HTTP responses with malformed chunk encoding or truncated final bytes returned to internal clients.

Monitoring Recommendations

Alert on process crash loops or restarts for services that perform outbound HTTP requests using AIOHTTP.
Track dependency-manifest drift in CI/CD pipelines so that AIOHTTP versions below 3.14.3 fail the build.
Capture and review egress HTTP traffic patterns to third-party APIs known to be unreliable or attacker-influenced.

How to Mitigate CVE-2026-69244

Immediate Actions Required

Upgrade AIOHTTP to version 3.14.3 or later across all Python runtimes, virtual environments, and container images.
Rebuild and redeploy any container images or serverless bundles that pin AIOHTTP as a transitive dependency.
Audit outbound HTTP client code to restrict connections to trusted upstream servers where feasible.

Patch Information

The fix is available in AIOHTTP 3.14.3. See the GitHub Release v3.14.3, the GitHub Security Advisory GHSA-cq5v-8q36-5273, the GitHub Pull Request Discussion, and the GitHub Commit Update for full technical detail.

Workarounds

Where an immediate upgrade is not possible, force the pure-Python HTTP parser by disabling the C parser at ClientSession construction to avoid the vulnerable _http_parser.pyx code path.
Constrain AIOHTTP clients to communicate only with trusted, validated HTTP servers until patching completes.
Wrap AIOHTTP client calls in supervised worker processes so that a parser-induced crash does not take down the parent service.

bash

# Upgrade AIOHTTP to the fixed version
pip install --upgrade "aiohttp>=3.14.3"

# Verify the installed version
python -c "import aiohttp; print(aiohttp.__version__)"

# Pin the minimum version in requirements.txt
echo 'aiohttp>=3.14.3' >> requirements.txt