Hi,

The following vulnerabilities were published for python-aiohttp.

CVE-2026-69243[0]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a
| request smuggling attack relating to WebSocket upgrades. If using
| the server-side component, an attacker may be able to execute a
| request smuggling vulnerability using an edge case in the WebSocket
| upgrade procedure. A WebSocket upgrade request with a body could
| cause the parser to switch protocols before the complete request
| body was received, leaving trailing bytes to be handled as upgraded-
| protocol or pipelined data rather than normal HTTP body data. This
| issue is fixed in version 3.14.2.


CVE-2026-69244[1]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.3, an out-of-bounds heap read could occur
| in the C response parser while building an error message for a
| malformed response. An attacker controlled server, or possibly an
| accidental response, could trigger a DoS in the client. The
| vulnerable path was error message construction in
| aiohttp/_http_parser.pyx, where an llhttp error-position pointer was
| used to build a snippet for malformed chunked responses and
| malformed request or response bytes at the buffer end. This issue is
| fixed in version 3.14.3.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-69243
https://www.cve.org/CVERecord?id=CVE-2026-69243
[1] https://security-tracker.debian.org/tracker/CVE-2026-69244
https://www.cve.org/CVERecord?id=CVE-2026-69244

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore