{"uuid": "2ef08a7f-32a7-4a6d-980c-c1c0fd1dd6b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "seen", "source": "https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3", "content": "# CVE-2026-69243: CVE-2026-69243: HTTP Request Smuggling via WebSocket Upgrade State Desynchronization in aiohttp\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69243\n\n## Summary\nAn asynchronous HTTP client/server framework for asyncio and Python, aiohttp prior to version 3.14.2 is vulnerable to HTTP Request Smuggling. The server-side HTTP parser immediately transitions the protocol state to 'upgraded' upon receiving a WebSocket upgrade request before consuming the accompanying request body. If the backend handler rejects the upgrade request while keeping the TCP connection alive, the unconsumed request body remains in the socket buffer and is parsed as a subsequent pipelined HTTP request. This allows an attacker to smuggle requests, bypass frontend reverse proxy controls, and perform unauthorized actions.\n\n## TL;DR\nPrior to version 3.14.2, aiohttp transitions its protocol state to 'upgraded' before reading the body of a WebSocket upgrade request. If the handler rejects the upgrade, any unconsumed body bytes are parsed as a new pipelined HTTP request, enabling request smuggling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Vector**: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\n- **Exploit Status**: poc\n- **KEV Status**: No\n- **Affected Component**: HTTP Parser\n\n## Affected Systems\n\n- aiohttp asynchronous server component\n- **aiohttp**: < 3.14.2 (Fixed in: `3.14.2`)\n\n## Mitigation\n\n- Upgrade to aiohttp version 3.14.2 or higher.\n- Block WebSocket upgrade requests that contain a non-empty request body at the reverse proxy layer.\n- Disable HTTP keep-alive or connection reuse for routes handling WebSocket upgrades.\n\n**Remediation Steps:**\n1. Update standard requirements.txt or dependency lockfiles to require 'aiohttp>=3.14.2'.\n2. Deploy the updated application containers or server instances.\n3. Verify the implementation by sending a test pipelined connection to confirm unconsumed bodies are properly handled without request smuggling.\n\n## References\n\n- [GitHub Security Advisory GHSA-mfx4-hv73-q22v](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v)\n- [Official Pull Request #13017](https://github.com/aio-libs/aiohttp/pull/13017)\n- [Commit 6ae358f0983c3f4d6f67692b2f8e65dc8e091c98](https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98)\n- [Release v3.14.2](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69243)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69243) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T03:31:26.704466Z"}