--- id: CVE-2025-69228 title: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python summary: >- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an applic… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-770 vendor: aiohttp product: aiohttp affected: - aiohttp < 3.13.3 patched: - aiohttp 3.13.3 published: '2026-01-06' updated: '2026-10-11' sourceUpdated: '2026-10-11T20:10:00.200' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69228' references: - url: >- https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60 label: security-advisories@github.com - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69228.json - url: 'https://access.redhat.com/security/cve/CVE-2025-69228' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427254' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-69228' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69228' - url: 'https://access.redhat.com/errata/RHSA-2026:6761' - url: 'https://access.redhat.com/errata/RHSA-2026:5809' - url: 'https://access.redhat.com/errata/RHSA-2026:6762' - url: 'https://access.redhat.com/errata/RHSA-2026:55853' - url: 'https://access.redhat.com/errata/RHSA-2026:55852' - url: 'https://access.redhat.com/errata/RHSA-2026:13545' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:41928' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:3782' - url: 'https://github.com/aio-libs/aiohttp' tags: - nvd - csaf - vex - red-hat - osv - pip epss: 0.00407 epssPercentile: 0.34838 aliases: - GHSA-6jhg-hg63-jvvf - PYSEC-2026-1100 ecosystem: pip scores: nvd: 7.5 vendor: 6.8 ingestedAt: '2026-07-08T18:25:46.486Z' --- ## Overview AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3. ## Affected - `aiohttp < 3.13.3` ## Remediation Upgrade past the affected range: - `aiohttp 3.13.3` ## Package advisory (CVE-2025-69228) Affected packages: - `aiohttp < 3.13.3` Patched in: - `aiohttp 3.13.3` Source: https://osv.dev/vulnerability/GHSA-6jhg-hg63-jvvf ## Vendor advisories - **RHSA-2026:6761** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6761) - **RHSA-2026:5809** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5809) - **RHSA-2026:6762** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6762) - **RHSA-2026:55853** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55853) - **RHSA-2026:55852** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55852) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928) - **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, … · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69228.json)