CVE-2026-111750
Description
A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP (Hypertext Transfer Protocol) request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an intermediary proxy that interprets message boundaries differently, resulting in HTTP request smuggling. This may allow an attacker to bypass security controls, poison web caches, or manipulate requests from other users.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires specific non-default configurations—specifically forcing the fallback pure-Python parser—alongside an upstream proxy that processes HTTP framing inconsistently. In standard Red Hat product deployments, aiohttp utilizes compiled native C extensions by default, which are not subject to this parsing flaw. Consequently, exploitation is restricted to environments where the C parser is explicitly disabled or unavailable, limiting the practical blast radius.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
