CVE-2026-69244: 
Wolfi vulnerability analysis and mitigation

CVE-2026-69244 is an out-of-bounds heap read vulnerability in the C HTTP response parser of AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. The flaw exists in versions up to and including 3.14.2, and was fixed in version 3.14.3. It was first published by the aiohttp maintainers on July 25, 2026, and added to the GitHub Advisory Database on August 3, 2026. It carries a CVSS v4.0 base score of 7.1 (High) (Github Advisory).

The root cause is an out-of-bounds heap read (CWE-125) in aiohttp/_http_parser.pyx, compounded by potential uncontrolled resource consumption (CWE-400) and use-after-free conditions (CWE-416). When the C parser encountered a malformed HTTP response — such as an invalid chunked transfer encoding — it built an error message snippet by dereferencing the raw llhttp_get_error_pos() pointer directly, causing Cython to materialize a C string from a bare pointer without bounds checking. This allowed the parser to read past the end of the allocated buffer. The fix (commit 49f65d5) reworks the error-message construction to compute an integer offset from the error pointer and slice the snippet from the already-bounded data bytes object, keeping all memory access within the original buffer (Github Advisory, Fix PR).

Successful exploitation causes a Denial of Service (DoS) in the aiohttp client process. An attacker-controlled server — or even an accidentally malformed server response — can trigger the out-of-bounds read, potentially crashing the client application or causing it to hang. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the affected client (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. The EPSS score is approximately 0.3% (22nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires passive user interaction — specifically, the aiohttp client must connect to and receive a response from a malicious or malformed server (Github Advisory).

1. Set up a malicious HTTP server: Configure a server to return a malformed HTTP response, such as a chunked response with an invalid chunk size (e.g., 0\rX\r\n\r\n) or malformed bytes at the end of the response buffer.
2. Induce the aiohttp client to connect: Trick or direct an aiohttp client application (running version ≤ 3.14.2 with C extensions enabled) to make an HTTP request to the attacker-controlled server.
3. Trigger the parser error path: When the client receives the malformed response, the C HTTP parser (HttpResponseParserC) invokes llhttp_get_error_pos() and attempts to build an error message snippet using the raw pointer, reading past the end of the buffer.
4. Achieve DoS: The out-of-bounds heap read causes the client process to crash or become unresponsive, resulting in a denial of service (Github Advisory, Fix PR).

• Logs: Application crash logs or Python tracebacks referencing aiohttp/_http_parser.pyx or BadHttpMessage exceptions with error snippets from HTTP parsing.
• Process: Unexpected termination or segmentation fault of the Python process running aiohttp client code after receiving an HTTP response.
• Network: HTTP responses from external servers containing malformed chunked transfer encoding (e.g., invalid chunk size characters, missing LF after chunk data) directed at aiohttp clients.

Upgrade aiohttp to version 3.14.3 or later, which contains the fix in commit 49f65d5 (aiohttp Release). For deployments that cannot immediately upgrade, the Python-based parser is unaffected by this vulnerability and can be enabled by setting the environment variable AIOHTTP_NO_EXTENSIONS=1 before starting the application (Github Advisory). Upgrading to 3.14.3 is the recommended long-term remediation.