Snyk agent scan: AIOHTTP: Pure-Python parser request smuggling (CVE-2026-111750)

The pure Python HTTP parser in AIOHTTP versions >=0.4.3 and <0.6.9 is susceptible to an HTTP request smuggling vulnerability. This issue arises when the Python parser is used, such as when the environment variable AIOHTTP_NO_EXTENSIONS is set or when a non-standard wheel is installed. The vulnerability allows an attacker to perform HTTP request smuggling attacks against applications using the affected parser. The recommended workaround is to switch to the default C parser, which is not vulnerable.

Applications using the pure Python HTTP parser in AIOHTTP within the affected versions may be vulnerable to HTTP request smuggling attacks. This can lead to potential manipulation of HTTP requests, which may affect the integrity and security of web communications. The vulnerability requires no privileges and no user interaction but has a low vector complexity and limited impact scope as per the CVSS vector.

A patch is available for this vulnerability. Users should switch from the pure Python parser to the default C parser to mitigate the risk. This can be done by not setting the AIOHTTP_NO_EXTENSIONS environment variable or by installing the standard wheel that includes the C parser. Follow vendor guidance for applying the official fix.