CLEANSTART-2026-EX36838 Security fixes in airflow-3 3.3.0-r2

Package airflow-3 version 3.3.0-r2 fixes 7 vulnerabilities: CVE-2026-69244, CVE-2026-59881, CVE-2026-69243, CVE-2026-69247, CVE-2026-69249...

CVE-2026-69243 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, airflow, py3-cassandra-medusa, kserve, open-webui...

Exploit for CVE-2026-69243

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request...

CVE-2026-69243

creationtimestamp| type| source ---|---|--- 2026-08-04 03:31:26+00:00| seen| https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3 2026-08-04 21:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96645 2026-08-05 00:00:21+00:00| published-proof-of-concept|...

Linux Distros Unpatched Vulnerability : CVE-2026-69243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack...

CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...