{"id":"CVE-2025-53643","title":"aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)","summary":"A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smug…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":"CWE-444","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI)","affected":["openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai","openshift_ai_rhoai","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","satellite_6_18_for_rhel 9","ansible_automation_platform 2.6","openshift_ai 2.22","openshift_ai 2.25","openshift_service_mesh 3.0","openshift_service_mesh 3.1"],"patched":["ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","satellite_6_18_for_rhel 9","ansible_automation_platform 2.6","openshift_ai 2.22","openshift_ai 2.25","openshift_service_mesh 3.0","openshift_service_mesh 3.1"],"published":"2025-07-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T10:12:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-53643"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380000"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53643"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"url":"https://access.redhat.com/errata/RHSA-2026:1506"},{"url":"https://access.redhat.com/errata/RHSA-2026:1249"},{"url":"https://access.redhat.com/errata/RHSA-2026:2760"},{"url":"https://access.redhat.com/errata/RHSA-2026:3960"},{"url":"https://access.redhat.com/errata/RHSA-2025:22759"},{"url":"https://access.redhat.com/errata/RHSA-2025:23531"},{"url":"https://access.redhat.com/errata/RHSA-2025:22939"},{"url":"https://access.redhat.com/errata/RHSA-2025:22944"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00355,"epssPercentile":0.29052,"aliases":["GHSA-9548-qrrj-x5pj","PYSEC-2026-1104"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:47.749Z","slug":"CVE-2025-53643","body":"## Overview\n\nA request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n## Vendor advisories\n\n- **RHSA-2026:1506** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1506)\n- **RHSA-2026:1249** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-01-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:1249)\n- **RHSA-2026:2760** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-02-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:2760)\n- **RHSA-2026:3960** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-03-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:3960)\n- **RHSA-2025:22759** · Red Hat · fixed in: Red Hat OpenShift AI 2.22 · released 2025-12-04 · [advisory](https://access.redhat.com/errata/RHSA-2025:22759)\n- **RHSA-2025:23531** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23531)\n- **RHSA-2025:22939** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2025-12-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:22939)\n- **RHSA-2025:22944** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2025-12-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:22944)\n- **Red Hat VEX** · Low · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI) · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json)\n\n**aiohttp: AIOHTTP HTTP Request/Response Smuggling** — rated Low by Red Hat. Released 2025-07-14, updated 2026-10-16.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Satellite 6.18 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift AI 2.22\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift Service Mesh 3.0\n- Red Hat OpenShift Service Mesh 3.1\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI)\n- OpenShift Lightspeed\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6 for RHEL 10\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Satellite 6.18 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift AI 2.22\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift Service Mesh 3.0\n- Red Hat OpenShift Service Mesh 3.1\n\n## Remediation\n\nRed Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2026:1506\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1249\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:2760\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-53643)\n\nAffected packages:\n\n- `aiohttp < 3.12.14`\n\nPatched in:\n\n- `aiohttp 3.12.14`\n\nSource: https://osv.dev/vulnerability/GHSA-9548-qrrj-x5pj","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218458,"id":"CVE-2025-53643","ts":1791533861555,"field":"cvss","old":null,"new":"3.7"}]}