--- id: CVE-2025-53643 title: 'aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)' summary: >- A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smug… severity: low cvss: 3.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N' cvssSource: vendor cwe: CWE-444 vendor: Red Hat product: Red Hat Enterprise Linux AI (RHEL AI) affected: - openshift_lightspeed - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai - openshift_ai_rhoai - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_18_for_rhel 9 - ansible_automation_platform 2.6 - openshift_ai 2.22 - openshift_ai 2.25 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 patched: - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_18_for_rhel 9 - ansible_automation_platform 2.6 - openshift_ai 2.22 - openshift_ai 2.25 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 published: '2025-07-14' updated: '2026-10-16' sourceUpdated: '2026-10-16T10:12:46+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json - url: 'https://access.redhat.com/security/cve/CVE-2025-53643' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2380000' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-53643' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53643' - url: >- https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj - url: 'https://access.redhat.com/errata/RHSA-2026:1506' - url: 'https://access.redhat.com/errata/RHSA-2026:1249' - url: 'https://access.redhat.com/errata/RHSA-2026:2760' - url: 'https://access.redhat.com/errata/RHSA-2026:3960' - url: 'https://access.redhat.com/errata/RHSA-2025:22759' - url: 'https://access.redhat.com/errata/RHSA-2025:23531' - url: 'https://access.redhat.com/errata/RHSA-2025:22939' - url: 'https://access.redhat.com/errata/RHSA-2025:22944' - url: 'https://github.com/aio-libs/aiohttp' tags: - csaf - vex - red-hat - osv - pip epss: 0.00355 epssPercentile: 0.29052 aliases: - GHSA-9548-qrrj-x5pj - PYSEC-2026-1104 ecosystem: pip ingestedAt: '2026-07-08T18:25:47.749Z' --- ## Overview A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections. ## Vendor advisories - **RHSA-2026:1506** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1506) - **RHSA-2026:1249** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-01-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:1249) - **RHSA-2026:2760** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-02-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:2760) - **RHSA-2026:3960** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-03-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:3960) - **RHSA-2025:22759** · Red Hat · fixed in: Red Hat OpenShift AI 2.22 · released 2025-12-04 · [advisory](https://access.redhat.com/errata/RHSA-2025:22759) - **RHSA-2025:23531** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23531) - **RHSA-2025:22939** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2025-12-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:22939) - **RHSA-2025:22944** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2025-12-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:22944) - **Red Hat VEX** · Low · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI) · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53643.json) **aiohttp: AIOHTTP HTTP Request/Response Smuggling** — rated Low by Red Hat. Released 2025-07-14, updated 2026-10-16. Affected: - OpenShift Lightspeed - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) - Red Hat OpenShift AI (RHOAI) Fixed: - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Satellite 6.18 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 - Red Hat OpenShift AI 2.22 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 No fix planned: - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) - OpenShift Lightspeed - Red Hat OpenShift AI (RHOAI) Not affected: - Red Hat Ansible Automation Platform 2.6 for RHEL 10 - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Satellite 6.18 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 - Red Hat OpenShift AI 2.22 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 ## Remediation Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2026:1506 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1249 Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:2760 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2025-53643) Affected packages: - `aiohttp < 3.12.14` Patched in: - `aiohttp 3.12.14` Source: https://osv.dev/vulnerability/GHSA-9548-qrrj-x5pj