Vulnerability-Lookup

OPENSUSE-SU-2026:20204-1

Vulnerability from csaf_opensuse - Published: 2026-02-12 14:01 - Updated: 2026-02-12 14:01

Summary

Security update for python-aiohttp, python-Brotli

Notes

Title of the patch

Security update for python-aiohttp, python-Brotli

Description of the patch

This update for python-aiohttp, python-Brotli fixes the following issues: Changes in python-aiohttp: - CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022). - CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020). - CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018). - CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017). - CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021). - CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019). - CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023). - CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517). Changes in python-Brotli: - Add max length decompression (bsc#1254867, bsc#1256017).

Patchnames

openSUSE-Leap-16.0-259

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-aiohttp, python-Brotli",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-aiohttp, python-Brotli fixes the following issues:\n\nChanges in python-aiohttp:\n\n- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).\n- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).\n- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).\n- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).\n- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).\n- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).\n- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).\n- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).\n\nChanges in python-Brotli:\n\n- Add max length decompression (bsc#1254867, bsc#1256017).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-259",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20204-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246517",
        "url": "https://bugzilla.suse.com/1246517"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254867",
        "url": "https://bugzilla.suse.com/1254867"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256017",
        "url": "https://bugzilla.suse.com/1256017"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256018",
        "url": "https://bugzilla.suse.com/1256018"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256019",
        "url": "https://bugzilla.suse.com/1256019"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256020",
        "url": "https://bugzilla.suse.com/1256020"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256021",
        "url": "https://bugzilla.suse.com/1256021"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256022",
        "url": "https://bugzilla.suse.com/1256022"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256023",
        "url": "https://bugzilla.suse.com/1256023"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53643 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53643/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69223 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69225 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69225/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69226 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69226/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69227 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69227/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69228 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69228/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69229 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69229/"
      }
    ],
    "title": "Security update for python-aiohttp, python-Brotli",
    "tracking": {
      "current_release_date": "2026-02-12T14:01:04Z",
      "generator": {
        "date": "2026-02-12T14:01:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20204-1",
      "initial_release_date": "2026-02-12T14:01:04Z",
      "revision_history": [
        {
          "date": "2026-02-12T14:01:04Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Brotli-1.1.0-160000.3.1.aarch64",
                "product": {
                  "name": "python313-Brotli-1.1.0-160000.3.1.aarch64",
                  "product_id": "python313-Brotli-1.1.0-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.3.1.aarch64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.3.1.aarch64",
                  "product_id": "python313-aiohttp-3.11.16-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Brotli-1.1.0-160000.3.1.ppc64le",
                "product": {
                  "name": "python313-Brotli-1.1.0-160000.3.1.ppc64le",
                  "product_id": "python313-Brotli-1.1.0-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.3.1.ppc64le",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.3.1.ppc64le",
                  "product_id": "python313-aiohttp-3.11.16-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Brotli-1.1.0-160000.3.1.s390x",
                "product": {
                  "name": "python313-Brotli-1.1.0-160000.3.1.s390x",
                  "product_id": "python313-Brotli-1.1.0-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.3.1.s390x",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.3.1.s390x",
                  "product_id": "python313-aiohttp-3.11.16-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Brotli-1.1.0-160000.3.1.x86_64",
                "product": {
                  "name": "python313-Brotli-1.1.0-160000.3.1.x86_64",
                  "product_id": "python313-Brotli-1.1.0-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.3.1.x86_64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.3.1.x86_64",
                  "product_id": "python313-aiohttp-3.11.16-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Brotli-1.1.0-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64"
        },
        "product_reference": "python313-Brotli-1.1.0-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Brotli-1.1.0-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le"
        },
        "product_reference": "python313-Brotli-1.1.0-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Brotli-1.1.0-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x"
        },
        "product_reference": "python313-Brotli-1.1.0-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Brotli-1.1.0-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64"
        },
        "product_reference": "python313-Brotli-1.1.0-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53643",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53643"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53643",
          "url": "https://www.suse.com/security/cve/CVE-2025-53643"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246517 for CVE-2025-53643",
          "url": "https://bugzilla.suse.com/1246517"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-53643"
    },
    {
      "cve": "CVE-2025-69223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host\u0027s memory. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69223",
          "url": "https://www.suse.com/security/cve/CVE-2025-69223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256017 for CVE-2025-69223",
          "url": "https://bugzilla.suse.com/1256017"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-69223"
    },
    {
      "cve": "CVE-2025-69224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69224",
          "url": "https://www.suse.com/security/cve/CVE-2025-69224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256018 for CVE-2025-69224",
          "url": "https://bugzilla.suse.com/1256018"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-69224"
    },
    {
      "cve": "CVE-2025-69225",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69225"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there\u0027s a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69225",
          "url": "https://www.suse.com/security/cve/CVE-2025-69225"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256019 for CVE-2025-69225",
          "url": "https://bugzilla.suse.com/1256019"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-69225"
    },
    {
      "cve": "CVE-2025-69226",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69226"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69226",
          "url": "https://www.suse.com/security/cve/CVE-2025-69226"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256020 for CVE-2025-69226",
          "url": "https://bugzilla.suse.com/1256020"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-69226"
    },
    {
      "cve": "CVE-2025-69227",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69227"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69227",
          "url": "https://www.suse.com/security/cve/CVE-2025-69227"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256021 for CVE-2025-69227",
          "url": "https://bugzilla.suse.com/1256021"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-69227"
    },
    {
      "cve": "CVE-2025-69228",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69228"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server\u0027s memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69228",
          "url": "https://www.suse.com/security/cve/CVE-2025-69228"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256022 for CVE-2025-69228",
          "url": "https://bugzilla.suse.com/1256022"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-69228"
    },
    {
      "cve": "CVE-2025-69229",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69229"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
          "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69229",
          "url": "https://www.suse.com/security/cve/CVE-2025-69229"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256023 for CVE-2025-69229",
          "url": "https://bugzilla.suse.com/1256023"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-Brotli-1.1.0-160000.3.1.x86_64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.aarch64",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.s390x",
            "openSUSE Leap 16.0:python313-aiohttp-3.11.16-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-12T14:01:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-69229"
    }
  ]
}

CVE-2025-69229 (GCVE-0-2025-69229)

Vulnerability from cvelistv5 – Published: 2026-01-05 23:37 – Updated: 2026-01-06 19:02

Title

AIOHTTP vulnerable to DoS through chunked messages

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

Severity ?

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/4ed97a…	x_refsource_MISC
	https://github.com/aio-libs/aiohttp/commit/dc3170…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:24:45.403446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:02:09.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T23:37:52.955Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"
        }
      ],
      "source": {
        "advisory": "GHSA-g84x-mcqj-x9qq",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP vulnerable to DoS through chunked messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69229",
    "datePublished": "2026-01-05T23:37:52.955Z",
    "dateReserved": "2025-12-29T20:53:34.537Z",
    "dateUpdated": "2026-01-06T19:02:09.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69228 (GCVE-0-2025-69228)

Vulnerability from cvelistv5 – Published: 2026-01-05 23:30 – Updated: 2026-01-06 19:02

Title

AIOHTTP vulnerable to denial of service through large payloads

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.

Severity ?

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/b7dbd3…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69228",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:03.661846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:02:29.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server\u0027s memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T23:30:33.440Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"
        }
      ],
      "source": {
        "advisory": "GHSA-6jhg-hg63-jvvf",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP vulnerable to denial of service through large payloads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69228",
    "datePublished": "2026-01-05T23:30:33.440Z",
    "dateReserved": "2025-12-29T20:53:24.489Z",
    "dateUpdated": "2026-01-06T19:02:29.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69227 (GCVE-0-2025-69227)

Vulnerability from cvelistv5 – Published: 2026-01-05 23:19 – Updated: 2026-01-06 19:02

Title

AIOHTTP vulnerable to DoS when bypassing asserts

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

Severity ?

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/bc1319…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69227",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:12.409319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:02:48.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T23:19:31.396Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"
        }
      ],
      "source": {
        "advisory": "GHSA-jj3x-wxrx-4x23",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP vulnerable to DoS when bypassing asserts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69227",
    "datePublished": "2026-01-05T23:19:31.396Z",
    "dateReserved": "2025-12-29T20:53:19.433Z",
    "dateUpdated": "2026-01-06T19:02:48.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69225 (GCVE-0-2025-69225)

Vulnerability from cvelistv5 – Published: 2026-01-05 23:16 – Updated: 2026-01-06 19:02

Title

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Severity ?

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/c7b7a0…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69225",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:19.119274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:02:59.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there\u0027s a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T23:16:19.158Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"
        }
      ],
      "source": {
        "advisory": "GHSA-mqqc-3gqh-h2x8",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69225",
    "datePublished": "2026-01-05T23:16:19.158Z",
    "dateReserved": "2025-12-29T20:52:59.444Z",
    "dateUpdated": "2026-01-06T19:02:59.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69223 (GCVE-0-2025-69223)

Vulnerability from cvelistv5 – Published: 2026-01-05 22:00 – Updated: 2026-01-06 19:04

Title

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/2b920c…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69223",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:26:17.561184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:04:01.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host\u0027s memory. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T22:00:17.715Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"
        }
      ],
      "source": {
        "advisory": "GHSA-6mq8-rvhq-8wgg",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP\u0027s HTTP Parser auto_decompress feature is vulnerable to zip bomb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69223",
    "datePublished": "2026-01-05T22:00:17.715Z",
    "dateReserved": "2025-12-29T20:45:58.699Z",
    "dateUpdated": "2026-01-06T19:04:01.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53643 (GCVE-0-2025-53643)

Vulnerability from cvelistv5 – Published: 2025-07-14 20:17 – Updated: 2025-07-15 19:50

Title

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Severity ?

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/e8d774…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.12.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53643",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-15T14:43:18.333063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-15T19:50:40.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.12.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-14T20:17:18.247Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"
        }
      ],
      "source": {
        "advisory": "GHSA-9548-qrrj-x5pj",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53643",
    "datePublished": "2025-07-14T20:17:18.247Z",
    "dateReserved": "2025-07-07T14:20:38.391Z",
    "dateUpdated": "2025-07-15T19:50:40.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-69226 (GCVE-0-2025-69226)

Vulnerability from cvelistv5 – Published: 2026-01-05 22:52 – Updated: 2026-01-06 19:03

Title

AIOHTTP allows for a brute-force leak of internal static ﬁlepath components

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/f2a86f…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:35.975954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:03:21.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T22:52:38.467Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"
        }
      ],
      "source": {
        "advisory": "GHSA-54jq-c3m8-4m76",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP allows for a brute-force leak of internal static \ufb01lepath components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69226",
    "datePublished": "2026-01-05T22:52:38.467Z",
    "dateReserved": "2025-12-29T20:53:09.411Z",
    "dateUpdated": "2026-01-06T19:03:21.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69224 (GCVE-0-2025-69224)

Vulnerability from cvelistv5 – Published: 2026-01-05 22:35 – Updated: 2026-01-06 19:03

Title

AIOHTTP's Unicode processing of header values could cause parsing discrepancies

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
	https://github.com/aio-libs/aiohttp/commit/32677f…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	aio-libs	aiohttp	Affected: < 3.13.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69224",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:43.789267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:03:34.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T22:35:42.084Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"
        }
      ],
      "source": {
        "advisory": "GHSA-69f9-5gxw-wvc2",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP\u0027s Unicode processing of header values could cause parsing discrepancies"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69224",
    "datePublished": "2026-01-05T22:35:42.084Z",
    "dateReserved": "2025-12-29T20:46:13.630Z",
    "dateUpdated": "2026-01-06T19:03:34.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:20204-1

CVE-2025-69229 (GCVE-0-2025-69229)

CVE-2025-69228 (GCVE-0-2025-69228)

CVE-2025-69227 (GCVE-0-2025-69227)

CVE-2025-69225 (GCVE-0-2025-69225)

CVE-2025-69223 (GCVE-0-2025-69223)

CVE-2025-53643 (GCVE-0-2025-53643)

CVE-2025-69226 (GCVE-0-2025-69226)

CVE-2025-69224 (GCVE-0-2025-69224)

Tags

Sightings

Nomenclature