HIGH

GHSA-cq5v-8q36-5273

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Quick fix

GHSA-cq5v-8q36-5273 — aiohttp: upgrade to the fixed version with the command below.

pip install --upgrade 'aiohttp>=3.14.3'

Details

### Summary

An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

### Impact

An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.

### Workaround

If unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.

---

Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d

Enter the version of the package you're using.

Introduced in: 0 Fixed in: 3.14.3

Fix pip install --upgrade 'aiohttp>=3.14.3'