All vulnerabilities
CVE-2026-111750GHSA-pqxq-w44r-73xw

AIOHTTP: Pure-Python parser request smuggling

aio-libs aiohttppipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.14.4Fixed versionGitHub
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 3.14.4aiohttp, pipGitHub
  • 3.14.4aiohttp, PyPIOSVpip install "aiohttp>=3.14.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

The pure Python parser is vulnerable to an HTTP request smuggling attack.

Impact

If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.

Workaround

Switch to the default C parser.

Text from GitHub Advisory Database

Affected versions 53

  • aiohttp, pip<= 3.14.3GitHub
  • aiohttpaffected: < 3.14.4CVE List
  • aiohttp, PyPIfrom first release, fixed in 3.14.4OSV
  • aiohttp, PyPI0.1OSV
  • aiohttp, PyPI0.10.0OSV
  • aiohttp, PyPI0.10.1OSV
  • aiohttp, PyPI0.10.2OSV
  • aiohttp, PyPI0.11.0OSV
  • aiohttp, PyPI0.12.0OSV
  • aiohttp, PyPI0.13.0OSV
  • aiohttp, PyPI0.13.1OSV
  • aiohttp, PyPI0.14.0OSV
  • aiohttp, PyPI0.14.1OSV
  • aiohttp, PyPI0.14.2OSV
  • aiohttp, PyPI0.14.3OSV
  • aiohttp, PyPI0.14.4OSV
  • aiohttp, PyPI0.15.0OSV
  • aiohttp, PyPI0.15.1OSV
  • aiohttp, PyPI0.15.2OSV
  • aiohttp, PyPI0.15.3OSV
  • aiohttp, PyPI0.16.0OSV
  • aiohttp, PyPI0.16.1OSV
  • aiohttp, PyPI0.16.2OSV
  • aiohttp, PyPI0.16.3OSV
  • aiohttp, PyPI0.16.4OSV
  • aiohttp, PyPI0.16.5OSV
  • aiohttp, PyPI0.16.6OSV
  • aiohttp, PyPI0.17.0OSV
  • aiohttp, PyPI0.17.1OSV
  • aiohttp, PyPI0.17.2OSV
  • aiohttp, PyPI0.17.3OSV
  • aiohttp, PyPI0.17.4OSV
  • aiohttp, PyPI0.18.0OSV
  • aiohttp, PyPI0.18.1OSV
  • aiohttp, PyPI0.18.2OSV
  • aiohttp, PyPI0.18.3OSV
  • aiohttp, PyPI0.18.4OSV
  • aiohttp, PyPI0.19.0OSV
  • aiohttp, PyPI0.2OSV
  • aiohttp, PyPI0.20.0OSV
  • aiohttp, PyPI0.20.1OSV
  • aiohttp, PyPI0.20.2OSV
  • aiohttp, PyPI0.21.0OSV
  • aiohttp, PyPI0.21.1OSV
  • aiohttp, PyPI0.21.2OSV
  • aiohttp, PyPI0.21.4OSV
  • aiohttp, PyPI0.21.5OSV
  • aiohttp, PyPI0.21.6OSV
  • aiohttp, PyPI0.22.0OSV
  • aiohttp, PyPI0.22.0a0OSV
  • aiohttp, PyPI0.22.0b0OSV
  • aiohttp, PyPI0.22.0b1OSV
  • aiohttp, PyPI0.22.0b2OSV

References 5