chore(deps): update dependency aiohttp to v3.14.3 [security] - autoclosed - #1984
Closed
renovate[bot] wants to merge 1 commit into
Closed
chore(deps): update dependency aiohttp to v3.14.3 [security] - autoclosed#1984renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
from
August 4, 2026 07:13
eccfcd7 to
b93b291
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.14.1→==3.14.3AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243 / GHSA-mfx4-hv73-q22v
More information
Details
Summary
The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.
Impact
If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.
Patch: aio-libs/aiohttp@6ae358f
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881 / GHSA-mq44-7p77-q5h7
More information
Details
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the
permessage-deflateextension was not negotiated.Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: aio-libs/aiohttp@47fb6ae
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-69244 / GHSA-cq5v-8q36-5273
More information
Details
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with
AIOHTTP_NO_EXTENSIONS=1.Patch: aio-libs/aiohttp@49f65d5
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
aio-libs/aiohttp (aiohttp)
v3.14.3Compare Source
===================
Bug fixes
Fixed the client dropping only the first
Authorization,CookieandProxy-Authorizationheader when a redirect crossed an origin -- by :user:arshsmith1.Related issues and pull requests on GitHub:
:issue:
13180.Fixed error message construction in the C HTTP parser -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
13222.v3.14.2Compare Source
===================
Bug fixes
Fixed :py:attr:
~aiohttp.web.StreamResponse.last_modifiedrounding a:class:
datetime.datetimewith a fractional second down.Related issues and pull requests on GitHub:
:issue:
5303.Fixed resolving
localhoston Windows to fall back withoutAI_ADDRCONFIGwhen the first lookup fails, so
localhoststill works without an activenetwork.
Related issues and pull requests on GitHub:
:issue:
5357.Rejected multipart body parts whose
Content-Lengthheader is not aplain sequence of digits (e.g.
+5,-1,1_0), matching thestrictness of the main request parser per :rfc:
9110#section-8.6-- by :user:
dxbjavid.Related issues and pull requests on GitHub:
:issue:
12794.Fixed
GunicornWebWorkerendlessly reloading when app fails during startup -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12879.Fixed some inconsistent case sensitivity on request methods -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12931.Fixed
IndexError: string index out of rangeinparse_content_dispositionwhen a header parameter has an empty value (e.g.
filename=).-- by :user:
JSap0914.Related issues and pull requests on GitHub:
:issue:
12948.Fixed the
sock_readtimeout being re-armed on a keep-alive connection afterit had been returned to the pool. An idle pooled connection could be left with a
pending read timeout that fired and poisoned it, so the next request reusing the
connection failed immediately with :exc:
aiohttp.SocketTimeoutError. The readtimeout is now only rescheduled when resuming a transport that was actually
paused -- by :user:
daragok.Related issues and pull requests on GitHub:
:issue:
12953, :issue:12954.Fixed the client decompressing frames when
permessage-deflatewas not negotiated -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12976.Fixed
DigestAuthMiddlewareraising anIndexErroron empty domain -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12983.Fixed :class:
~aiohttp.DigestAuthMiddlewarecorrupting theDigestchallenge when a
WWW-Authenticateresponse offered more than oneauthentication scheme -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12984.Fixed client not closing cleanly after an exception -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12985.Fixed control frames breaking fragmented WebSocket messages -- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
12988.Fixed
parse_content_dispositionrejecting otherwise-validContent-Dispositionheader values that contain optional whitespace (OWS)around the disposition type (e.g.
"form-data ; name=\"field\"").The disposition type is now stripped before token validation, consistent with
how parameter keys are already handled -- by :user:
JSap0914.Related issues and pull requests on GitHub:
:issue:
12996.Fixed an :exc:
IndexErrorin the pure-Python HTTP parser -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13001.Fixed parsing optional whitespace in Content-Disposition -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13002.Fixed request body not being read on rejected WebSocket upgrades -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13016.Fixed :exc:
LookupError(and an unguarded :exc:UnicodeDecodeError) escapingContent-Dispositionparsing when a multipart part supplies an extendedparameter with an unknown charset
-- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
13042.Fixed
escape_quotesin the Digest authentication middleware not escapingbackslashes, so a
WWW-Authenticatechallenge value containing a backslashcould break out of its quoted-string in the generated
Authorizationheader-- by :user:
dxbjavid.Related issues and pull requests on GitHub:
:issue:
13054.Fixed Python parser not rejecting a bare
LFin the request line -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13136.Fixed the C HTTP parser folding the fragment into the query string for an
origin-form request target with an empty query (e.g.
/path?#frag),which diverged from the pure-Python parser -- by :user:
GiulioDER.Related issues and pull requests on GitHub:
:issue:
13171.Fixed the C parser reporting newer HTTP methods such as
QUERYas<unknown>;the method table is now derived from the vendored llhttp instead of a hand-maintained count
-- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13174.Packaging updates and notes for downstreams
Upgraded
llhttpto v9.4.2 -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12956.Contributor-facing changes
Added admin documentation on incident response and on running reproducer code
safely, covering security vulnerability handling and supply-chain, account, and
CI/infrastructure compromise -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12914.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.