CVE-2026-47265

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

In the AIOHTTP library before version 3.14.1, a vulnerability allows bypassing the max_line_size check in HTTP requests when using the optimized C parser. An attacker can send oversized lines, causing excessive memory consumption and potentially leading to a DoS attack.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

AIOHTTP, an asynchronous HTTP framework for Python, prior to version 3.14.0 has a vulnerability in the CookieJar.load() function that allows arbitrary code execution when using untrusted input. Most applications use this function with their own data, so the risk is low, but if attacker-controlled files are loaded, remote code execution may occur.

AIOHTTP versions 3.13.2 and below have a vulnerability where reading multiple invalid cookies can cause a logging storm. An attacker can craft a Cookie header to trigger excessive warning logs if the cookies attribute is accessed.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.