Live › vulnerability › CVE-2026-111750
Go to dashboardaiohttp's pure-Python HTTP parser can be tricked into request smuggling (CWE-444), where a front-end proxy and the aiohttp backend disagree on where one request ends. An attacker who can send crafted requests can slip hidden requests past front-end controls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
Check whether AIOHTTP_NO_EXTENSIONS is set in the environment, or whether aiohttp was installed without a compiled C-extension wheel (e.g. pip show aiohttp and confirm the C parser is in use).
3.14.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111750")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.