1379 matches found
CVE-2026-69244 vulnerabilities
Vulnerabilities for packages: puppygraph-python, apache-beam-python-3.13-sdk, airflow, py3.13-scanner-test-libraries-aiohttp, airflow-core, apache-beam-python-3.11-sdk, kserve-models-web-app, apache-beam-python-3.12-sdk...
GHSA-MFX4-HV73-Q22V vulnerabilities
Vulnerabilities for packages: puppygraph-python, apache-beam-python-3.13-sdk, airflow, py3.13-scanner-test-libraries-aiohttp, airflow-core, apache-beam-python-3.11-sdk, kserve-models-web-app, apache-beam-python-3.12-sdk...
CVE-2026-69243 vulnerabilities
Vulnerabilities for packages: puppygraph-python, apache-beam-python-3.13-sdk, airflow, py3.13-scanner-test-libraries-aiohttp, airflow-core, apache-beam-python-3.11-sdk, kserve-models-web-app, apache-beam-python-3.12-sdk...
GHSA-CQ5V-8Q36-5273 vulnerabilities
Vulnerabilities for packages: puppygraph-python, apache-beam-python-3.13-sdk, airflow, py3.13-scanner-test-libraries-aiohttp, airflow-core, apache-beam-python-3.11-sdk, kserve-models-web-app, apache-beam-python-3.12-sdk...
AIOHTTP: HTTP request smuggling via WebSocket upgrade
SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...
PYSEC-2026-3546 AIOHTTP: HTTP request smuggling via WebSocket upgrade
Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...
DEBIAN-CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...
CVE-2026-69244
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is...
CVE-2026-69244
AIOHTTP vulnerability CVE-2026-69244 affects the aiohttp library prior to 3.14.3. The issue is an out-of-bounds heap read in the C-based response parser during error message construction, specifically in aiohttp/_http_parser.pyx where an llhttp error-position pointer is used to build a snippet fo...
CVE-2026-69244
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
EUVD-2026-52438
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
GHSA-MFX4-HV73-Q22V AIOHTTP: HTTP request smuggling via WebSocket upgrade
Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...
AIOHTTP: HTTP request smuggling via WebSocket upgrade
Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...
CVE-2026-69243
Affected software: AIOHTTP (async HTTP client/server for asyncio and Python). Vulnerability: HTTP request smuggling in the server-side WebSocket upgrade path due to the HTTP parser handling a WebSocket upgrade request with a body in a way that may allow trailing bytes to be misinterpreted as upgr...
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...
CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Summary The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated. Impact A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to ...