CVE-2026-69244

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

In the AIOHTTP library before version 3.14.1, a vulnerability allows bypassing the max_line_size check in HTTP requests when using the optimized C parser. An attacker can send oversized lines, causing excessive memory consumption and potentially leading to a DoS attack.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

In AIOHTTP prior to version 3.14.0, cookies set via the `cookies` parameter are sent after a cross-origin redirect. If a developer uses the `cookies` parameter per-request, sensitive data might leak to an attacker controlling the redirect.

AIOHTTP, an asynchronous HTTP framework for Python, prior to version 3.14.0 has a vulnerability in the CookieJar.load() function that allows arbitrary code execution when using untrusted input. Most applications use this function with their own data, so the risk is low, but if attacker-controlled files are loaded, remote code execution may occur.

A vulnerability in AIOHTTP versions 3.13.2 and below allows a zip bomb attack that, upon decompression, can exhaust host memory and cause a DoS.

The vulnerability in aiohttp allows an attacker to modify an HTTP request or create a new one if they control the HTTP version. This issue only occurs if the attacker can control the HTTP version of the request.