aiohttp CVE-2026-69243

Exploitation requires that the target be using aiohttp's server-side component (not the client). The attacker must send a WebSocket upgrade request (Connection: Upgrade, Upgrade: websocket) that also includes a request body (via Content-Length with a value greater than zero, or Transfer-Encoding: chunked), which is an edge case not typical of standard WebSocket handshakes. The CVSS vector confirms no authentication or special privileges are required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to aiohttp server deployments on versions 3.14.1 and earlier; client-only usage is not affected. The AC:H rating reflects that the attacker must deliberately craft this non-standard upgrade request with a body, and the actual downstream impact depends on the server's routing architecture - standalone aiohttp deployments may exhibit lower real-world impact than those sitting behind a shared reverse proxy where connection-level smuggling could poison shared state.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) gives a base score of 6.3. AC:H accurately reflects that triggering the vulnerability requires crafting a WebSocket upgrade request that also carries a body - an unusual but well-defined HTTP construction. The integrity impact is Low (VI:L), consistent with request smuggling's ability to influence routing and boundary parsing rather than directly overwrite data. No confidentiality or availability impact is assessed, which aligns with classical smuggling primitives. No EPSS data was provided in the input, so exploitation probability is inferred from available signals only: the GHSA advisory explicitly states 'AIOHTTP is unaware of any public exploit code', and the vulnerability is not in CISA KEV. Real-world exploitation risk is constrained by AC:H and the requirement to target the server-side component specifically; client-only aiohttp users are unaffected. The integrity risk is real but bounded - an attacker able to craft the specific malformed upgrade request could potentially inject a secondary HTTP request into a connection, which may affect backend systems in reverse-proxy deployments. There is no conflicting signal between the CVSS vector and the description; both indicate a network-reachable, unauthenticated, low-integrity impact.

An attacker sends a crafted HTTP GET request to an aiohttp server with both a WebSocket upgrade header (Connection: Upgrade, Upgrade: websocket) and a non-zero Content-Length body. On vulnerable versions, the parser elevates to WebSocket protocol mode before reading the body, causing the body bytes - which the attacker has constructed to resemble a second HTTP request - to be parsed as a pipelined or protocol-level message. In a reverse-proxy scenario, this trailing fake request could be forwarded to a backend as a distinct authorized request, potentially bypassing access controls or poisoning a shared connection pool. No public exploit code exists at time of analysis.