aiohttp EUVD-2026-104486

Exploitation requires BOTH: (1) the application running aiohttp's pure-Python HTTP parser - triggered by setting the AIOHTTP_NO_EXTENSIONS environment variable or running without the standard compiled (llhttp C extension) wheel; and (2) a front-end intermediary/reverse proxy that interprets the ambiguous HEAD-with-Content-Length framing differently than the backend. Default installations that use the compiled C parser are NOT vulnerable. The flaw is unauthenticated (PR:N) and needs no user interaction, but the non-default parser configuration plus the required proxy/backend parsing disagreement (CVSS 4.0 AT:P) are the primary factors limiting real-world exploitability.

This is a medium-severity, conditionally-exploitable HTTP request smuggling flaw (CWE-444) rather than a drop-everything priority. The vendor CVSS 4.0 score of 6.3 encodes the key caveat directly in the vector: AT:P (attack requirements present) reflects that exploitation is not possible against default deployments. Although PR:N/UI:N/AV:N signal an unauthenticated, remote, no-interaction vector, the impact metrics are only Low across integrity/availability (VI:L/VA:L/SI:L/SA:L) with no confidentiality on the vulnerable system (VC:N), consistent with a desync bug that corrupts request framing rather than directly leaking data or granting code execution. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence set, so there is no evidence of active or at-scale exploitation; the only exploitation artifact is a regression test embedded in the fix commit, which is not a weaponized POC. The decisive limiting factor is that the bug lives in the pure-Python parser, which only runs when AIOHTTP_NO_EXTENSIONS is set or the compiled C (llhttp) extension is unavailable - the standard wheel install is not affected. Net: treat as a real but niche risk, high priority only for the subset of deployments knowingly running the pure-Python parser behind a differently-parsing intermediary.

An aiohttp application is deployed with AIOHTTP_NO_EXTENSIONS (or without the compiled wheel) behind a reverse proxy that frames HTTP differently. An unauthenticated attacker sends a HEAD request carrying a Content-Length and a trailing smuggled request; because the pure-Python parser wrongly treats the HEAD body as absent, the proxy and backend disagree on message boundaries and the attacker's hidden request is processed as if legitimate. No public weaponized exploit was provided - only a regression test in the fix commit demonstrates the framing desync.