DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69243: CVE-2026-69243: HTTP Request Smuggling via WebSocket Upgrade State Desynchronization in aiohttp

#security #cve #cybersecurity

CVE-2026-69243: HTTP Request Smuggling via WebSocket Upgrade State Desynchronization in aiohttp

Vulnerability ID: CVE-2026-69243
CVSS Score: 6.3
Published: 2026-08-03

An asynchronous HTTP client/server framework for asyncio and Python, aiohttp prior to version 3.14.2 is vulnerable to HTTP Request Smuggling. The server-side HTTP parser immediately transitions the protocol state to 'upgraded' upon receiving a WebSocket upgrade request before consuming the accompanying request body. If the backend handler rejects the upgrade request while keeping the TCP connection alive, the unconsumed request body remains in the socket buffer and is parsed as a subsequent pipelined HTTP request. This allows an attacker to smuggle requests, bypass frontend reverse proxy controls, and perform unauthorized actions.

TL;DR

Prior to version 3.14.2, aiohttp transitions its protocol state to 'upgraded' before reading the body of a WebSocket upgrade request. If the handler rejects the upgrade, any unconsumed body bytes are parsed as a new pipelined HTTP request, enabling request smuggling.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-444
  • Attack Vector: Network (AV:N)
  • CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  • Exploit Status: poc
  • KEV Status: No
  • Affected Component: HTTP Parser

Affected Systems

  • aiohttp asynchronous server component
  • aiohttp: < 3.14.2 (Fixed in: 3.14.2)

Code Analysis

Commit: 6ae358f

Fixed request body not being read on rejected WebSocket upgrades

Exploit Details

  • aiohttp regression tests: The official test suite contains regression tests verifying the vulnerability path by pipelining a request behind a rejected websocket upgrade request.

Mitigation Strategies

  • Upgrade to aiohttp version 3.14.2 or higher.
  • Block WebSocket upgrade requests that contain a non-empty request body at the reverse proxy layer.
  • Disable HTTP keep-alive or connection reuse for routes handling WebSocket upgrades.

Remediation Steps:

  1. Update standard requirements.txt or dependency lockfiles to require 'aiohttp>=3.14.2'.
  2. Deploy the updated application containers or server instances.
  3. Verify the implementation by sending a test pipelined connection to confirm unconsumed bodies are properly handled without request smuggling.

References

Read the full report for CVE-2026-69243 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)