Update dependency aiohttp to v3.14.3 [SECURITY] - autoclosed - #320
Update dependency aiohttp to v3.14.3 [SECURITY] - autoclosed#320renovate[bot] wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — trivial patch-version bump, no code changes needed.
Extended reasoning...
Overview
Single-line change in template/requirements.txt pinning aiohttp from 3.14.1 to 3.14.2, a patch release. This is an auto-generated Renovate dependency update PR addressing two medium-severity aiohttp CVEs (WebSocket permessage-deflate decompression without negotiation, and a WebSocket-upgrade HTTP request smuggling edge case).
Security risks
No new risk is introduced by this PR itself — it only pulls in upstream fixes. aiohttp here is a dependency inside the Jupyter sandbox template (template/requirements.txt), not a production-facing service, so the blast radius of the underlying CVEs is limited to that sandbox context. No application code changed.
Level of scrutiny
Minimal scrutiny is warranted: this is a mechanical version bump with no logic changes, generated by Renovate, and it only tightens security posture (upgrading a vulnerable dependency to a patched version). There is no ambiguity or design decision for a human to weigh in on.
Other factors
No CODEOWNERS-sensitive paths, no test changes required for a dependency patch bump, and the PR diff is fully contained to one line.
renovate
Bot
changed the title
a6c3ec8 to
1bcf3fd
Compare
1bcf3fd to
657b14e
Compare
|
already merged |
Pull request was closed
renovate
Bot
changed the title
1 participant
This PR contains the following updates:
==3.14.1→==3.14.3AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881 / GHSA-mq44-7p77-q5h7
More information
Details
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the
permessage-deflateextension was not negotiated.Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: aio-libs/aiohttp@47fb6ae
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243 / GHSA-mfx4-hv73-q22v
More information
Details
Summary
The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.
Impact
If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.
Patch: aio-libs/aiohttp@6ae358f
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-69244 / GHSA-cq5v-8q36-5273
More information
Details
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with
AIOHTTP_NO_EXTENSIONS=1.Patch: aio-libs/aiohttp@49f65d5
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
aio-libs/aiohttp (aiohttp)
v3.14.3Compare Source
===================
Bug fixes
Fixed the client dropping only the first
Authorization,CookieandProxy-Authorizationheader when a redirect crossed an origin -- by :user:arshsmith1.Related issues and pull requests on GitHub:
:issue:
13180.Fixed error message construction in the C HTTP parser -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
13222.v3.14.2Compare Source
===================
Bug fixes
Fixed :py:attr:
~aiohttp.web.StreamResponse.last_modifiedrounding a:class:
datetime.datetimewith a fractional second down.Related issues and pull requests on GitHub:
:issue:
5303.Fixed resolving
localhoston Windows to fall back withoutAI_ADDRCONFIGwhen the first lookup fails, so
localhoststill works without an activenetwork.
Related issues and pull requests on GitHub:
:issue:
5357.Rejected multipart body parts whose
Content-Lengthheader is not aplain sequence of digits (e.g.
+5,-1,1_0), matching thestrictness of the main request parser per :rfc:
9110#section-8.6-- by :user:
dxbjavid.Related issues and pull requests on GitHub:
:issue:
12794.Fixed
GunicornWebWorkerendlessly reloading when app fails during startup -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12879.Fixed some inconsistent case sensitivity on request methods -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12931.Fixed
IndexError: string index out of rangeinparse_content_dispositionwhen a header parameter has an empty value (e.g.
filename=).-- by :user:
JSap0914.Related issues and pull requests on GitHub:
:issue:
12948.Fixed the
sock_readtimeout being re-armed on a keep-alive connection afterit had been returned to the pool. An idle pooled connection could be left with a
pending read timeout that fired and poisoned it, so the next request reusing the
connection failed immediately with :exc:
aiohttp.SocketTimeoutError. The readtimeout is now only rescheduled when resuming a transport that was actually
paused -- by :user:
daragok.Related issues and pull requests on GitHub:
:issue:
12953, :issue:12954.Fixed the client decompressing frames when
permessage-deflatewas not negotiated -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12976.Fixed
DigestAuthMiddlewareraising anIndexErroron empty domain -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12983.Fixed :class:
~aiohttp.DigestAuthMiddlewarecorrupting theDigestchallenge when a
WWW-Authenticateresponse offered more than oneauthentication scheme -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12984.Fixed client not closing cleanly after an exception -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12985.Fixed control frames breaking fragmented WebSocket messages -- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
12988.Fixed
parse_content_dispositionrejecting otherwise-validContent-Dispositionheader values that contain optional whitespace (OWS)around the disposition type (e.g.
"form-data ; name=\"field\"").The disposition type is now stripped before token validation, consistent with
how parameter keys are already handled -- by :user:
JSap0914.Related issues and pull requests on GitHub:
:issue:
12996.Fixed an :exc:
IndexErrorin the pure-Python HTTP parser -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13001.Fixed parsing optional whitespace in Content-Disposition -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13002.Fixed request body not being read on rejected WebSocket upgrades -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13016.Fixed :exc:
LookupError(and an unguarded :exc:UnicodeDecodeError) escapingContent-Dispositionparsing when a multipart part supplies an extendedparameter with an unknown charset
-- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
13042.Fixed
escape_quotesin the Digest authentication middleware not escapingbackslashes, so a
WWW-Authenticatechallenge value containing a backslashcould break out of its quoted-string in the generated
Authorizationheader-- by :user:
dxbjavid.Related issues and pull requests on GitHub:
:issue:
13054.Fixed Python parser not rejecting a bare
LFin the request line -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13136.Fixed the C HTTP parser folding the fragment into the query string for an
origin-form request target with an empty query (e.g.
/path?#frag),which diverged from the pure-Python parser -- by :user:
GiulioDER.Related issues and pull requests on GitHub:
:issue:
13171.Fixed the C parser reporting newer HTTP methods such as
QUERYas<unknown>;the method table is now derived from the vendored llhttp instead of a hand-maintained count
-- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13174.Packaging updates and notes for downstreams
Upgraded
llhttpto v9.4.2 -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12956.Contributor-facing changes
Added admin documentation on incident response and on running reproducer code
safely, covering security vulnerability handling and supply-chain, account, and
CI/infrastructure compromise -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12914.Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.