DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69244: CVE-2026-69244: Heap Out-of-Bounds Read in aiohttp C-Parser Error Handling

#security #cve #cybersecurity

CVE-2026-69244: Heap Out-of-Bounds Read in aiohttp C-Parser Error Handling

Vulnerability ID: CVE-2026-69244
CVSS Score: 7.1
Published: 2026-08-03

A high-severity heap-based out-of-bounds (OOB) read vulnerability exists in the Cython-based HTTP response and request parser extension of aiohttp. When processing malformed HTTP traffic, the parser fails to properly handle raw C pointers returned by the underlying llhttp library during error-message construction. This triggers an uncontrolled strlen() call on non-null-terminated network buffers, which can result in a Denial of Service (DoS) via worker process crash or the exposure of adjacent heap memory inside exception messages.

TL;DR

A heap out-of-bounds read in the C-parser of aiohttp allows unauthenticated remote attackers to crash application processes or leak adjacent heap memory by sending specially crafted malformed HTTP requests or responses.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-125
  • Attack Vector: Network
  • CVSS v4.0 Score: 7.1
  • EPSS Score: Not Available
  • Vulnerability Class: Heap Out-of-Bounds Read
  • Exploit Status: Proof-of-Concept (PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • aiohttp client-side applications running on versions prior to 3.14.3 with C extensions enabled
  • aiohttp server-side applications running on versions prior to 3.14.3 with C extensions enabled
  • aiohttp: < 3.14.3 (Fixed in: 3.14.3)

Code Analysis

Commit: 49f65d5

Fix out-of-bounds heap read in C HTTP parser during error message construction

@@ -675,11 +675,12 @@ cdef class HttpParser:\n                     ex = self._last_error\n                     self._last_error = None\n                 else:\n-                    after = cparser.llhttp_get_error_pos(self._cparser)\n-                    before = data[:after - base]\n-                    after_b = after.split(b"\\r\\n", 1)[0]\n+                    error_pos = cparser.llhttp_get_error_pos(self._cparser)\n+                    error_off = error_pos - base\n+                    before = data[:error_off]\n+                    after = data[error_off:].split(b"\\r\\n", 1)[0]\n                     before = before.rsplit(b"\\r\\n", 1)[-1]\n-                    data = before + after_b\n+                    data = before + after\n                     pointer = " " * (len(repr(before))-1) + "^"\n                     ex = parser_error_from_errno(self._cparser, data, pointer)\n                 self._payload = None
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • aio-libs repository tests: Regression test cases simulating truncated chunked transfer payloads that trigger the C-parser crash.

Mitigation Strategies

  • Upgrade aiohttp to version 3.14.3 or later to apply the safe integer-offset parsing logic.
  • Disable compiled C extensions by setting AIOHTTP_NO_EXTENSIONS=1 to force the safe pure-Python parser fallback.
  • Implement edge web application firewalls (WAF) to block malformed chunked transfer encoding payloads before they reach backend application servers.

Remediation Steps:

  1. Identify all python environments, Dockerfiles, and requirements.txt files specifying aiohttp.
  2. Run 'pip install -U aiohttp>=3.14.3' to apply the official vendor patch.
  3. In legacy environments, add 'ENV AIOHTTP_NO_EXTENSIONS=1' to the container Dockerfile as a temporary hotfix.
  4. Restart all affected application worker processes and monitor container crash logs for exit code 139 (SIGSEGV).

References

Read the full report for CVE-2026-69244 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)