UNKNOWN PyPI
AIOHTTP: Pure-Python parser request smuggling
GHSA-pqxq-w44r-73xw · CVE-2026-111750
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
The pure Python parser is vulnerable to an HTTP request smuggling attack.
Impact
If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.
Workaround
Switch to the default C parser.
References
- WEB https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-111750
- WEB https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83
- PACKAGE https://github.com/aio-libs/aiohttp
- WEB https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
Ready to move
Start Securing
Free, no credit card | First findings in minutes