CVE-2026-69243

COMPONENT VERSION RANGE

NewScan fingerprints aiohttp from its response and reports this CVE when the detected version falls inside the affected range below.

Request Smuggling was an UNCOVERED class for us until this row (2026-08-04 triage): aiohttp's parsers mis-handle the framing of a WebSocket upgrade, so a front end and an aiohttp back end can disagree on where one request ends - the desync primitive behind cache poisoning, front-end ACL bypass and request hijacking. Deliberately a version-gated advisory row and NOT an active probe: the only in-band proof of a real desync is replaying a poisoned prefix onto another connection (destructive) or a response-time delta (banned - see the no-timing rule), so the version IS the honest evidence here. Version source: the `aiohttp/x.y.z` Server-header signature added the same day; all releases before 3.14.2 are affected, hence no `ge`.