CVE-2025-53643Low· 3.7▾ SunlitA request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smug…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
— → 3.7
Last analysed / modified upstream
0.3% → 0.4%
A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections.
aiohttp: AIOHTTP HTTP Request/Response Smuggling — rated Low by Red Hat. Released 2025-07-14, updated 2026-10-16.
Affected:
Fixed:
No fix planned:
Not affected:
Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2026:1506 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1249 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:2760
Workarounds / mitigations:
Affected packages:
aiohttp < 3.12.14Patched in:
aiohttp 3.12.14Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-52304Medium· 5.9aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304)
CVE-2024-52303High· 7.5aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVE-2024-52303)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
CVE-2025-6985High· 7.5langchain-text-splitters: XXE Vulnerability in langchain-text-splitters (CVE-2025-6985)
CVE-2024-47874High· 7.5starlette: Starlette Denial of service (DoS) via multipart/form-data (CVE-2024-47874)