CVE-2026-111750CWE-444

CVE-2026-111750

published October 19, 2026

CVSS
6.3
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-10-19T21:17Z
References (3)
https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83 · [email protected]https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 · [email protected]https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 17:06Z
    AIOHTTP: Pure-Python parser request smuggling
    cvelistv5
  • 19 OCT 17:06Z
    AIOHTTP: Pure-Python parser request smuggling
    cvelistv5