Every CVE Search/ Get API key

CVE-2026-69244

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

7.1 HighFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.53%Up 0.2 points since Aug 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
CVE-2026-69244
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-416, CWE-125
Updated
2026-11-02
EUVDEUVD-2026-52438 7.1

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
EUVD-2026-52438
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-cq5v-8q36-5273 7.1

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary

An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

Impact

An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.

Workaround

If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTP_NO_EXTENSIONS=1.

Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d

Record
GHSA-cq5v-8q36-5273
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125, CWE-400, CWE-416
Updated
2026-11-02
NVD 7.1

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
CVE-2026-69244
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-125, CWE-400, CWE-416
Updated
2026-11-02
OSV 7.1

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
CVE-2026-69244
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125, CWE-400, CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-69244 7.1

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
DEBIAN-CVE-2026-69244
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 18 moreShow less
OSVGHSA-cq5v-8q36-5273 7.1

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary

An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

Impact

An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.

Workaround

If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTP_NO_EXTENSIONS=1.

Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d

Record
GHSA-cq5v-8q36-5273
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125, CWE-400, CWE-416
Updated
2026-11-02
OSVPYSEC-2026-3545 7.1

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary

An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

Impact

An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.

Workaround

If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTP_NO_EXTENSIONS=1.

Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d

Record
PYSEC-2026-3545
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:59135 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:59135
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:59136 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:59136
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63327 8.1

Red Hat Security Advisory: Satellite 6.16.13 Async Update

Record
RHSA-2026:63327
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63385 8.8

Red Hat Security Advisory: Satellite 6.19.4 Async Update

Record
RHSA-2026:63385
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63386 8.1

Red Hat Security Advisory: Satellite 6.18.9 Async Update

Record
RHSA-2026:63386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63387 8.1

Red Hat Security Advisory: Satellite 6.17.11 Async Update

Record
RHSA-2026:63387
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-69244 7.1

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
UBUNTU-CVE-2026-69244
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-94553 No score

CVE-2026-69244 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

Record
AZL-94553
Updated
2026-11-05
OSVCLSA-2026-1786515832 No score

TuxCare security update for aiohttp (3 CVEs)

TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.6.post9+tuxcare.

Record
CLSA-2026-1786515832
Updated
2026-11-02
OSVCLSA-2026-1788347890 No score

TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post11+tuxcare.

Record
CLSA-2026-1788347890
Updated
2026-11-02
OSVCLSA-2026-1791189274 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.10.11.post1+tuxcare.

Record
CLSA-2026-1791189274
Updated
2026-11-02
OSVopenSUSE-SU-2026:11467-1 No score

python313-aiohttp-3.14.3-1.1 on GA media

These are all security issues fixed in the python313-aiohttp-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11467-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21687-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
  • CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
  • CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
Record
openSUSE-SU-2026:21687-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-69244 No score

CVE-2026-69244 in aiohttp - Patched by Root

Root has patched CVE-2026-69244 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-69244
Updated
2026-11-02
OSVSUSE-SU-2026:23571-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
  • CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
  • CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
Record
SUSE-SU-2026:23571-1
Updated
2026-11-02
OSVSUSE-SU-2026:4031-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
  • CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
  • CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
Record
SUSE-SU-2026:4031-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 through 3.14.2
3.14.3
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 3 CVEs
 3.8.6 up to 3.8.6.post9+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare
3.8.6.post9+tuxcare
aiohttp
TuxCare:PyPI
 3.8.5 up to 3.8.5.post11+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare
Show 5 moreShow less
3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post11+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.10.11 up to 3.10.11.post1+tuxcare
3.10.11.post1+tuxcare
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 before 3.14.3-1, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-1
Show 9 moreShow less
3.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-5
3.14.3-1
aiohttp
PyPI
 before 3.14.3, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.14.3
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
Show 124 moreShow less
Affected packages
PackageAffectedFixed
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el8ap
0:2.5.20260824-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el9ap
0:2.5.20260824-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el8ap
0:3.1.59-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el8ap
0:3.14.3-1.el8ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:2.6.13-1.el9ap
0:2.6.13-1.el9ap
python-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
openvox-server
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el8sat
0:8.15.2-1.el8sat
openvox-server
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el8sat
0:8.15.2-1.el8sat
openvox-server
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
openvox-server
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
python-aiohttp
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite_utils:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
openvox-server
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
ansible-core
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
python3.12-aiohttp
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-gitpython
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.1.59-1.el9pc
0:3.1.59-1.el9pc
python3.12-gitpython
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.1.59-1.el9pc
0:3.1.59-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
pulpcore-obsolete-packages
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:1.3.1-5.el9pc
0:1.3.1-5.el9pc
python3.12-pulpcore
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.73.30-3.el9pc
0:3.73.30-3.el9pc
openvox-server
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
pulpcore-obsolete-packages
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:1.3.1-5.el9pc
0:1.3.1-5.el9pc
python3.12-pulpcore
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.73.30-3.el9pc
0:3.73.30-3.el9pc
ansible-core
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
python3.12-aiohttp
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
ansible-core
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
openvox-server
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
python-aiohttp
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
aiohttp
Root:PyPI
 before 3.12.14+aikido.7
3.12.14+aikido.73.14.1+aikido.13.8.6+aikido.123.8.6+aikido.133.12.14+aikido.83.14.1+aikido.23.9.5+aikido.63.13.3+aikido.153.13.4+aikido.63.12.15+aikido.83.14.0+aikido.43.13.5+aikido.53.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.9.5+aikido.73.12.15+aikido.93.12.14+aikido.93.13.5+aikido.63.13.3+aikido.163.13.4+aikido.73.14.0+aikido.53.14.1+aikido.33.14.0+aikido.63.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 3.11.16-160000.7.1
3.11.16-160000.7.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 3.11.16-160000.7.1
3.11.16-160000.7.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.9.3-150400.10.46.1
3.9.3-150400.10.46.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 3 CVEs
 before 3.9.3-150400.10.46.1
3.9.3-150400.10.46.1
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:26.10
 All versions, plus listed versions
3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known
python-aiohttp
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 3.14.3-1.1
3.14.3-1.1
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 3.11.16-160000.7.1
3.11.16-160000.7.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-69244 is a high vulnerability (CVSS 7.1) in Aio-libs Aiohttp, published August 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in aiohttp 3.14.3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 259 versions and 96 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open