CVE-2026-69243: 
Wolfi vulnerability analysis and mitigation

CVE-2026-69243 is an HTTP request smuggling vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, affecting all versions up to and including 3.14.1. The flaw exists in the HTTP parser's handling of WebSocket upgrade requests that include a body, causing the parser to switch protocols before the complete request body is received. This leaves trailing bytes to be interpreted as upgraded-protocol or pipelined data rather than normal HTTP body data. The vulnerability was reported by researcher shivams0099, published to the GitHub Advisory Database on August 3, 2026, and carries a CVSS v4.0 base score of 6.3 (Medium/Moderate) (Github Advisory, aiohttp Security Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). In vulnerable versions, when the HTTP parser encounters a WebSocket upgrade request containing a body (with a Content-Length or Transfer-Encoding: chunked header), it prematurely sets the _upgraded flag upon seeing the upgrade headers rather than deferring the protocol switch until the full request body has been consumed. The fix introduces a _pending_upgrade flag that defers the protocol switch until the body is fully read, as required by RFC 9110 Section 7.8. The patch modifies both the C extension (_http_parser.pyx) and the pure-Python (http_parser.py) parsers to correctly sequence body reads before protocol switching (aiohttp PR #13017, Fix Commit). Exploitation requires the attacker to be able to send crafted HTTP requests to an aiohttp server-side deployment, typically through or alongside a reverse proxy or load balancer.

Successful exploitation allows an unauthenticated network attacker to smuggle HTTP requests by injecting malicious data into the request stream that the server processes as a separate, trusted request. This can lead to bypassing security controls (such as authentication or access control enforced by a front-end proxy), poisoning intermediary caches, or causing the server to process attacker-controlled data as if it originated from a legitimate source. The primary impact is on integrity (low), with no direct confidentiality or availability impact assessed by CVSS v4.0, though the practical consequences in multi-tier architectures can be more severe (Github Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub, containing both Python (poc.py) and Rust binary implementations along with a Docker Compose lab environment that demonstrates request-count mismatches as evidence of the CWE-444 split (PoC Repository). The PoC demonstrates bypassing access controls via a reverse proxy by sending crafted payloads. As of the advisory date, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.275% (20th percentile), indicating a relatively low near-term exploitation probability. Exploitation is rated as high complexity due to the need to craft specific WebSocket upgrade requests with bodies and the dependency on a particular deployment topology (Github Advisory).

1. Reconnaissance: Identify aiohttp-based server deployments (versions ≤ 3.14.1) sitting behind a reverse proxy or load balancer, using tools like Shodan, Censys, or HTTP fingerprinting techniques.
2. Craft smuggling payload: Construct an HTTP request that includes WebSocket upgrade headers (Connection: Upgrade, Upgrade: websocket) along with a body (using Content-Length or Transfer-Encoding: chunked) followed immediately by a second, smuggled HTTP request.
3. Send the crafted request: Transmit the combined payload to the aiohttp server endpoint (e.g., /ws). The vulnerable parser prematurely switches to the upgraded protocol before consuming the full body, leaving the trailing bytes (the smuggled request) to be processed as a new pipelined or upgraded-protocol message.
4. Achieve smuggling objective: The smuggled request is processed by the server as if it were a legitimate, separate request — potentially bypassing authentication or access controls enforced by the front-end proxy, poisoning caches, or triggering unauthorized server-side actions (PoC Repository, Github Advisory).

• Network: Unusual HTTP requests to WebSocket upgrade endpoints (e.g., paths with Connection: Upgrade and Upgrade: websocket headers) that also include a non-zero Content-Length or Transfer-Encoding: chunked body; unexpected pipelined requests immediately following WebSocket upgrade attempts from the same connection.
• Logs: aiohttp access logs showing a single TCP connection serving multiple distinct HTTP requests where the first is a WebSocket upgrade with a body; discrepancies between request counts logged by a front-end proxy versus the aiohttp backend (more requests processed by backend than sent by proxy).
• Application Behavior: Requests reaching protected backend endpoints that should have been blocked by a front-end proxy's access controls; unexpected cache entries for restricted resources.

The primary remediation is to upgrade aiohttp to version 3.14.2 or later, which contains the fix (commit 6ae358f) that defers protocol switching until the complete WebSocket upgrade request body has been read (aiohttp Release v3.14.2, Github Advisory). If immediate patching is not feasible, consider implementing WAF or reverse proxy rules to reject WebSocket upgrade requests that include a non-empty body, or restrict WebSocket upgrade access to trusted clients only. Deployments not using the aiohttp server-side component (i.e., using only the client library) are not affected.

The vulnerability was discovered by researcher shivams0099 and remediated by aiohttp maintainer Dreamsorcerer (Github Advisory). A technical write-up and PoC walkthrough was published at glitchedcat.com shortly after disclosure (GlitchedCat PoC Write-up). Detection coverage was added by Qualys and Tenable Nessus (plugin IDs 331895 and 333342) within days of the advisory publication. AUSCERT issued bulletins (ESB-2026.9306 and ESB-2026.9567) for downstream awareness.