# CVE-2026-69243 - aiohttp (< 3.14.2) server-side HTTP request smuggling via the
# WebSocket upgrade path (CWE-444): a GET request carrying "Upgrade: websocket" plus a
# non-empty body (Content-Length > 0) makes the parser switch protocols before the body
# is consumed, so the smuggled bytes in the body are treated as a second/pipelined request.
# A legitimate WebSocket handshake carries no request body, so an upgrade request with a
# non-zero Content-Length is the anomaly.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-69243 aiohttp WebSocket Upgrade HTTP Request Smuggling"; flow:established,to_server; http.method; content:"GET"; http.header; content:"websocket"; nocase; fast_pattern; content:"Upgrade"; nocase; content:"Content-Length"; nocase; pcre:"/^Upgrade\x3a\x20*websocket/Hmi"; pcre:"/^Content-Length\x3a\x20*0*[1-9]/Hmi"; classtype:web-application-attack; reference:cve,CVE-2026-69243; reference:url,https://www.exploit.observer/?keyword=CVE-2026-69243&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=aiohttp&match=exact; sid:1091000; rev:1;)