Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | 3.14.3-1 | — |
| Debian 13 | python-aiohttp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-aiohttp | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-aiohttp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | rubygem-jwt | 2.10.3-1.el8sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Maintenance 6 | ansible-core | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | ansible-core +1 | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | openvox-server | 8.15.2-1.el8sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | pulpcore-obsolete-packages | 1.3.1-5.el9pc | RHSA-2026:63386 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.14.3-1.el8pc | RHSA-2026:63387, RHSA-2026:63327 |
| Red Hat Satellite Capsule 6 | python3.12-aiohttp | 3.14.3-1.el9pc | RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | python3.12-gitpython | 3.1.59-1.el9pc | RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | python3.12-pulpcore | 3.73.30-3.el9pc | RHSA-2026:63386 |
| Red Hat Satellite Capsule 6 | rubygem-jwt | 2.10.3-1.el8sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | ansible-core +1 | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | openvox-server | 8.15.2-1.el8sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | pulpcore-obsolete-packages | 1.3.1-5.el9pc | RHSA-2026:63386 |
| Red Hat Satellite 6 | python-aiohttp +1 | 3.14.3-1.el8pc | RHSA-2026:63387, RHSA-2026:63327 |
| Red Hat Satellite 6 | python3.12-aiohttp | 3.14.3-1.el9pc | RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | python3.12-gitpython | 3.1.59-1.el9pc | RHSA-2026:63385 |
| Red Hat Satellite 6 | python3.12-pulpcore | 3.73.30-3.el9pc | RHSA-2026:63386 |
| Red Hat Satellite 6 | rubygem-jwt | 2.10.3-1.el8sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller-cli | 4.6.32-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform Developer 2 | python-django +1 | 5.2.17-1.el10ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-django | 5.2.17-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-controller-cli +1 | 4.6.32-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260824-1.el8ap | RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.13-1.el9ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform 2 | python-django +1 | 5.2.17-1.el10ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform 2 | python3.12-aiohttp | 3.14.3-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | python3.12-django | 5.2.17-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.59-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-aiohttp | 3.9.3-150400.10.46.1 | SUSE-SU-2026:4031-1 |
| SLES 3 | python-aiohttp | 3.9.3-150400.10.46.1 | SUSE-SU-2026:4031-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-aiohttp | 3.11.16-160000.7.1 | SUSE-SU-2026:23571-1 |
| SLES 16.0 | python-aiohttp | 3.11.16-160000.7.1 | SUSE-SU-2026:23571-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-aiohttp | 3.14.3-1.1 | openSUSE-SU-2026:11467-1 |
| openSUSE Leap 16.0 | python-aiohttp | 3.11.16-160000.7.1 | openSUSE-SU-2026:21687-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-aiohttp | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | python39-oci-sdk +1 | 2.187.0-1.0.5.el9 | ELSA-2026-604898 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.3.0-r4 | — |
| Wolfi rolling | dask-kubernetes | 2026.3.0-r11 | — |
| Wolfi rolling | kserve +2 | 0.20.0-r7 | — |
| Wolfi rolling | open-webui | 0.11.0-r6 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.29.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | aiohttp | < 3.14.3 | 3.14.3 | GHSA-cq5v-8q36-5273 |
Advisories 11
- ELSA-2026-604898 Important: python-oci-sdk security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
- RHSA-2026:63387 Red Hat Security Advisory: Satellite 6.17.11 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63386 Red Hat Security Advisory: Satellite 6.18.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63385 Red Hat Security Advisory: Satellite 6.19.4 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63327 Red Hat Security Advisory: Satellite 6.16.13 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:59135 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:59136 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2026:23571-1 Security update for python-aiohttp SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:4031-1 Security update for python-aiohttp SUSE / openSUSE Security Updates · Sep 13, 2026
- openSUSE-SU-2026:21687-1 Security update for python-aiohttp SUSE / openSUSE Security Updates · Aug 31, 2026
- openSUSE-SU-2026:11467-1 python313-aiohttp-3.14.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 7, 2026