PyPI/aiohttp CVE-2026-69243: medium, EPSS 0.44%

AIOHTTP: HTTP request smuggling via WebSocket upgrade

Action: Upgrade aiohttp to 3.14.2 or later.

pip install aiohttp==3.14.2

Affected

Fixed versions

Sources

• osv: GHSA-mfx4-hv73-q22v
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v
• https://github.com/aio-libs/aiohttp/pull/13017
• https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
• https://github.com/aio-libs/aiohttp
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2

CVE-2026-69243 · published 2026-08-03T20:46:10Z · modified 2026-09-10T03:51:14.385788837Z · JSON