CVE-2026-111750 aio-libs CVE debrief

Who should care

Defenders responsible for maintaining applications that use AIOHTTP should assess their exposure and prioritize upgrading to version 3.14.4 or later. They should also verify if their applications are using vulnerable versions and monitor for potential request smuggling attacks.

Why it matters

CVE-2026-111750 is a vulnerability in the AIOHTTP library that can lead to request smuggling attacks. Defenders should prioritize upgrading to version 3.14.4 or later and assess their applications' use of AIOHTTP.

• Request smuggling attacks can lead to unauthorized access to sensitive data or disruption of service.
• Defenders need to verify if their applications are using vulnerable versions of AIOHTTP.
• Upgrading to AIOHTTP version 3.14.4 or later can mitigate this vulnerability.

Technical summary

The AIOHTTP library, a popular asynchronous HTTP client/server framework for asyncio and Python, has a vulnerability in its pure Python parser. Prior to version 3.14.4, the parser accepts ambiguous HTTP request framing, which can lead to request smuggling attacks. An unauthenticated attacker can exploit this vulnerability when an application uses AIOHTTP_NO_EXTENSIONS or runs without a standard wheel and an intermediary interprets the framing differently.

Defensive priority

Defenders should prioritize upgrading to AIOHTTP version 3.14.4 or later to mitigate this vulnerability. They should also assess their applications' use of AIOHTTP and verify if they are using vulnerable versions.

Recommended defensive actions

• Upgrade to AIOHTTP version 3.14.4 or later
• Assess applications' use of AIOHTTP and verify if they are using vulnerable versions
• Monitor for potential request smuggling attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, its impact, and the fixed version. However, there is limited information about potential exploits or attacks in the wild. Defenders should verify if their applications are using vulnerable versions of AIOHTTP and assess their exposure. The pure Python parser in AIOHTTP versions prior to 3.14.4 accepts ambiguous HTTP request framing, which can lead to request smuggling attacks. There is no information on in-the-wild exploitation, but defenders should prioritize 3.4

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.