High [CVE-2026-69244] Denial of Service via malformed HTTP responses

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end.

This issue is fixed in version 3.14.3. This is an Important severity flaw in aiohttp that could lead to a denial of service in client applications.

A remote, malicious HTTP server could send a specially crafted response, causing an out-of-bounds read in the aiohttp C response parser and resulting in the client application terminating unexpectedly. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-125.

Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 9 more.