要点
- CVE-2026-69244 是影响 aiohttp 的高危 (CVSS 7.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.53%，高于 44.7% 的漏洞。
- 修复：升级到 3.14.3 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.3
| 3.14.3
|
Description
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTP_NO_EXTENSIONS=1.
Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free