{"id":"CVE-2026-111750","aliases":[],"cve":{"records":[{"id":"CVE-2026-111750","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-16T17:52:09.081Z","published":"2026-10-19T17:06:37.997Z","modified":"2026-10-28T15:27:37.704Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-19T17:06:37.997Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-28T15:27:37.704Z"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-444","description":"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T15:27:28.793398Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"AIOHTTP: Pure-Python parser request smuggling","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.","score":6.3,"severity":"medium","published":"2026-10-19T17:06:37.997Z","modified":"2026-10-28T15:27:37.704Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"aio-libs","name":"aiohttp","platforms":[],"versions":[{"version":"< 3.14.4","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-111750"}],"remediation":[],"references":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw","https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"sources":[{"name":"CVE","id":"CVE-2026-111750","modified":"2026-10-28T15:27:37.704Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111750"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","score":6.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:29:56.913Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:30:31.757Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"AIOHTTP, an asynchronous HTTP client/server framework, has a vulnerability in versions prior to 3.14.4, where the pure Python parser accepts ambiguous HTTP request framing, allowing an unauthenticated attacker to smuggle requests under certain conditions. The issue is fixed in version 3.14.4. An intermediary must interpret the framing differently for the attack to be successful.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:12:47.209Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111750"}]}}