CVE-2026-69244
highPriorität · verfolgen · 0EPSS 0.005 · 44. PerzentilEUFRUSEPSS · bewertet 2026-10-27
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.9–7.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (2)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-cq5v-8q36-5273AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)2026-08-03ghsa · osvUS
### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. ### Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. ### Workaround If unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`. --- Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PYSEC-2026-3545AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)2026-08-04vendor · osvUS
### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. ### Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. ### Workaround If unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`. --- Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322dcnnvd
- https://github.com/aio-libs/aiohttp/pull/13223cnnvd
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3cnnvd
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273cnnvd
- https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322denisa_euvd
- https://github.com/aio-libs/aiohttp/pull/13223enisa_euvd
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3enisa_euvd
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan