CVE-2026-111750: aiohttp < 3.14.4

Affected technology

aiohttp · < 3.14.4
aio-libs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality impact as none; integrity and availability impact as low.