This CVE presents as a medium-severity request smuggling flaw in aiohttp's WebSocket upgrade handling, but the CVSS 6.3 rating materially understates the risk profile you should care about.
The core issue: aiohttp accepts WebSocket upgrade requests that include a message body. According to RFC 6455, the upgrade mechanism uses headers for protocol negotiation—no body should exist. When aiohttp processes an upgrade request with trailing bytes, it leaves the parser in an ambiguous state about where the HTTP request ends and where upgraded WebSocket traffic begins. Those trailing bytes become available to whatever comes next on the same connection, creating the classic desync condition where client, proxy, and server disagree on request boundaries.
The 3.14.2 patch addresses this by rejecting upgrade requests that contain bodies. This is input validation, not a parser state machine correction. That distinction matters: the underlying ambiguity in how aiohttp transitions from HTTP to WebSocket protocol handling still exists in the codebase—you're now just protected from the specific attack vector of sending a body. Bypass techniques through encoding variations or other protocol transition points remain theoretically possible.
The practical risk multiplier is your architecture. Single-server deployments face limited exposure—you'd need an attacker controlling the client. But if aiohttp sits behind any reverse proxy, load balancer, or cloud WAF that buffers and re-chunks requests, the trailing-bytes confusion can create a desync between the proxy's interpretation of where the upgrade request ends and aiohttp's interpretation. That's the attack surface that matters: cache poisoning, credential hijacking on shared infrastructure, and WAF bypass become possible without direct client control.
Your priority: upgrade to 3.14.2 immediately. Then audit whether aiohttp is deployed behind any buffering proxy and verify how that proxy handles WebSocket upgrade requests—mismatched handling there is where exploitation lives. The EPSS score of 0.00275 likely reflects the direct smuggling primitive's constraints but underweights the multi-tier desync scenario that represents most production deployments.
This is the second desync vulnerability in aiohttp's protocol transition handling in recent releases (CVE-2024-23334 addressed transfer-encoding ambiguity). The pattern suggests the upgrade path is code that hasn't received parser-level security attention—it works, gets refactored without security review, and accumulates state drift. Expect follow-on CVEs in this area within the next 18 months.