High [CVE-2026-69243] HTTP Request Smuggling via WebSocket Upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure.

A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources. Moderate impact.

This vulnerability in aiohttp's HTTP parser enables request smuggling when the server-side component handles WebSocket upgrade requests containing a body. An attacker could exploit an edge case during protocol switching, causing trailing data to be processed as subsequent requests or upgraded protocol data.

This affects Red Hat products utilizing aiohttp in a server-side capacity. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

Weakness: CWE-444.