{"vulnerability": "CVE-2026-69244", "sightings": [{"uuid": "66b67c2a-36a2-433b-ae96-c21307aa78b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69244", "type": "seen", "source": "https://gist.github.com/alon710/cb22e8e296a36049522556dbfd0c36bc", "content": "# CVE-2026-69244: CVE-2026-69244: Heap Out-of-Bounds Read in aiohttp C-Parser Error Handling\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69244\n\n## Summary\nA high-severity heap-based out-of-bounds (OOB) read vulnerability exists in the Cython-based HTTP response and request parser extension of aiohttp. When processing malformed HTTP traffic, the parser fails to properly handle raw C pointers returned by the underlying llhttp library during error-message construction. This triggers an uncontrolled strlen() call on non-null-terminated network buffers, which can result in a Denial of Service (DoS) via worker process crash or the exposure of adjacent heap memory inside exception messages.\n\n## TL;DR\nA heap out-of-bounds read in the C-parser of aiohttp allows unauthenticated remote attackers to crash application processes or leak adjacent heap memory by sending specially crafted malformed HTTP requests or responses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: Not Available\n- **Vulnerability Class**: Heap Out-of-Bounds Read\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- aiohttp client-side applications running on versions prior to 3.14.3 with C extensions enabled\n- aiohttp server-side applications running on versions prior to 3.14.3 with C extensions enabled\n- **aiohttp**: < 3.14.3 (Fixed in: `3.14.3`)\n\n## Mitigation\n\n- Upgrade aiohttp to version 3.14.3 or later to apply the safe integer-offset parsing logic.\n- Disable compiled C extensions by setting AIOHTTP_NO_EXTENSIONS=1 to force the safe pure-Python parser fallback.\n- Implement edge web application firewalls (WAF) to block malformed chunked transfer encoding payloads before they reach backend application servers.\n\n**Remediation Steps:**\n1. Identify all python environments, Dockerfiles, and requirements.txt files specifying aiohttp.\n2. Run 'pip install -U aiohttp>=3.14.3' to apply the official vendor patch.\n3. In legacy environments, add 'ENV AIOHTTP_NO_EXTENSIONS=1' to the container Dockerfile as a temporary hotfix.\n4. Restart all affected application worker processes and monitor container crash logs for exit code 139 (SIGSEGV).\n\n## References\n\n- [GitHub Security Advisory GHSA-cq5v-8q36-5273](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273)\n- [CVE-2026-69244 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69244)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69244) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T21:32:44.870700Z"}]}