--- id: CVE-2025-69227 title: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python summary: >- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If … severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-835 vendor: aiohttp product: aiohttp affected: - aiohttp < 3.13.3 patched: - aiohttp 3.13.3 published: '2026-01-06' updated: '2026-10-11' sourceUpdated: '2026-10-11T20:10:00.200' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69227' references: - url: >- https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259 label: security-advisories@github.com - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23 label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69227.json - url: 'https://access.redhat.com/security/cve/CVE-2025-69227' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427256' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-69227' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69227' - url: 'https://access.redhat.com/errata/RHSA-2026:6761' - url: 'https://access.redhat.com/errata/RHSA-2026:5809' - url: 'https://access.redhat.com/errata/RHSA-2026:6762' - url: 'https://access.redhat.com/errata/RHSA-2026:55853' - url: 'https://access.redhat.com/errata/RHSA-2026:55852' - url: 'https://access.redhat.com/errata/RHSA-2026:13553' - url: 'https://access.redhat.com/errata/RHSA-2026:13545' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:41928' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:3782' - url: 'https://github.com/aio-libs/aiohttp' tags: - nvd - csaf - vex - red-hat - osv - pip epss: 0.00396 epssPercentile: 0.3362 aliases: - GHSA-jj3x-wxrx-4x23 - PYSEC-2026-1107 ecosystem: pip ingestedAt: '2026-07-08T18:25:50.811Z' --- ## Overview AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3. ## Affected - `aiohttp < 3.13.3` ## Remediation Upgrade past the affected range: - `aiohttp 3.13.3` ## Package advisory (CVE-2025-69227) Affected packages: - `aiohttp < 3.13.3` Patched in: - `aiohttp 3.13.3` Source: https://osv.dev/vulnerability/GHSA-jj3x-wxrx-4x23 ## Vendor advisories - **RHSA-2026:6761** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6761) - **RHSA-2026:5809** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5809) - **RHSA-2026:6762** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6762) - **RHSA-2026:55853** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55853) - **RHSA-2026:55852** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55852) - **RHSA-2026:13553** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13553) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928) - **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, … · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69227.json)