GHSA-CQ5V-8Q36-5273 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is...

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the C HTTP response parser error handling. An attacker can cause the application to crash or become unresponsive by sending a specially crafted malformed chunked response. Workaround This vulnerability can be mitigated...

CVE-2026-69244

AIOHTTP vulnerability CVE-2026-69244 affects the aiohttp library prior to 3.14.3. The issue is an out-of-bounds heap read in the C-based response parser during error message construction, specifically in aiohttp/_http_parser.pyx where an llhttp error-position pointer is used to build a snippet fo...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

EUVD-2026-52438

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

EUVD-2026-50409

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2634 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: GHSA-2M8V-J782-FHVR...

NPM: Socket.IO: Zero-attachment Memory Exhaustion

NPM: Socket.IO: Zero-attachment Memory Exhaustion vulnerability discovered by ? in WordPress Npm socket.io-parser versions 3.3.6...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1123 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: OSV:GHSA-2M8V-J782-FHVR...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1123 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: SNYK:JS-SOCKETIOPARSER-18517008...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2634 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: SNYK:JS-SOCKETIOPARSER-18517008...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1123 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: GHSA-2M8V-J782-FHVR...