highCVE-2026-69244Aug 3, 2026

CVE-2026-69244: aiohttp Out-of-Bounds Heap Read in C HTTP Response Parser

Rohit Hatagale
AI Security Researcher, SecureLayer7

A malformed chunked HTTP response from an attacker-controlled server can crash the aiohttp client by triggering an out-of-bounds heap read inside the compiled C parser, causing a denial of service.

Packageaiohttp
Ecosystempip
Affected<= 3.14.2
Fixed in3.14.3
CVE-2026-69244: aiohttp Out-of-Bounds Heap Read in C HTTP Response Parser

The problem

aiohttp's C HTTP response parser (the default when installing from a pre-built wheel) contains a bug in its error-reporting path for malformed chunked responses.

When the parser encounters a bad chunk-size or a missing CRLF terminator, it attempts to build a diagnostic error message. During that step it reads from a heap buffer position that is already invalid, producing an out-of-bounds read. The result is a process crash, giving any server the client connects to a reliable way to kill the client.

Proof of concept

A working proof-of-concept for CVE-2026-69244 in aiohttp, with the exact payload below.

http
HTTP/1.1 200 OK
Transfer-Encoding: chunked

ZZZZZZZZ

The chunk-size field contains non-hex bytes ('Z' characters). The C parser rejects the value and enters its error path to build a diagnostic message. Before the patch, that error path referenced a buffer pointer or length derived from the partially consumed input, which at that point is no longer valid on the heap, triggering the out-of-bounds read (CWE-125) and potentially a use-after-free (CWE-416).

The patch (commit 49f65d5, PR #13223) corrects the pointer arithmetic and bounds check inside the Cython extension before the error-message string is assembled, so the parser safely raises a Python exception instead of reading past the buffer. The pure-Python parser does not share this code path and was never affected.

The fix

Upgrade aiohttp to 3.14.3 or later. If you cannot upgrade immediately, set the environment variable AIOHTTP_NO_EXTENSIONS=1 before starting your application to force the pure-Python parser, which is not affected by this bug.

Reported by Dreamsorcerer.

References: [1][2][3][4][5]

Related research