The vulnerability CVE-2026-69243 affects aiohttp's HTTP parser by enabling HTTP request smuggling during WebSocket upgrade requests that contain a body. The parser may switch protocols before fully receiving the body, causing trailing data to be incorrectly processed as subsequent requests or protocol data. This can lead to bypassing security controls or unauthorized resource access. Red Hat products using aiohttp server-side components are affected. The issue is rated as having moderate impact by Red Hat, with a CVSS base score of 7.0 by Red Hat's assessment. The advisory references a new satellite/iop-insights-engine-rhel9 container image generally available, but no direct patch or fix for this vulnerability is explicitly stated. Red Hat recommends consulting their Satellite documentation for installation and configuration of Red Hat Lightspeed. The vulnerability is related to CWE-444 (Inconsistent Interpretation of HTTP Requests) and CWE-125.

The vulnerability allows an attacker to perform HTTP request smuggling via WebSocket upgrade requests containing a body, potentially enabling bypass of firewall protections, unauthorized access to web applications, and web cache poisoning. The impact is rated as moderate by Red Hat, with high confidentiality impact, low integrity and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance. Red Hat has released a new container image for Red Hat Satellite including Red Hat Lightspeed, but no explicit fix for CVE-2026-69243 is currently stated. Users should follow Red Hat Satellite documentation for installing and configuring Red Hat Lightspeed locally to generate recommendations without sending data externally. Customers should monitor Red Hat advisories for updates or fixes and consult their Technical Account Manager if applicable.