Skip to content
Fencer Vulns
high 7.5

CVE-2025-69228 json

AIOHTTP vulnerable to denial of service through large payloads

published 2026-01-05 10 mo ago modified 2026-10-11 28 d ago also EUVD-2026-1044 , GHSA-6jhg-hg63-jvvf , PYSEC-2026-1100

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.

Patch / fix

  • pypi aiohttp 3.13.3
  • aiohttp aiohttp 3.13.3
  • python-aiohttp Debian 12 3.8.4-1+deb12u2
  • python-aiohttp Debian 13 3.11.16-1+deb13u1
  • python-aiohttp Debian 14 3.13.3-1

debian advisories DEBIAN-CVE-2025-69228

  • python-aiohttp Ubuntu 25.10 3.11.16-1ubuntu0.1
  • python-aiohttp Ubuntu Pro 18.04 LTS 3.0.1-1ubuntu0.1~esm6
  • python-aiohttp Ubuntu Pro 22.04 LTS 3.8.1-4ubuntu0.2+esm2
  • python-aiohttp Ubuntu Pro 24.04 LTS 3.9.1-1ubuntu0.1+esm2

ubuntu advisories UBUNTU-CVE-2025-69228

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-aiohttp SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 3.6.0-150100.3.32.1
  • python-aiohttp SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 3.9.3-150400.10.36.1
  • python-Brotli SLES for SAP applications 16.0, SLES 16.0 1.1.0-160000.3.1
  • python-aiohttp SLES for SAP applications 16.0, SLES 16.0 3.11.16-160000.3.1

suse advisories SUSE-SU-2026:0859-1SUSE-SU-2026:0858-1SUSE-SU-2026:20425-1

  • python-Brotli openSUSE Leap 16.0 1.1.0-160000.3.1
  • python-aiohttp openSUSE Leap 16.0 3.11.16-160000.3.1
  • python-aiohttp openSUSE Tumbleweed 3.13.3-1.1

opensuse advisories openSUSE-SU-2026:20204-1openSUSE-SU-2026:10025-1

  • py3-aiohttp Alpine 3.24, Alpine 3.23 3.13.3-r0

alpine advisories ALPINE-CVE-2025-69228

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-69228 updated cvss 6.8

aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/grafana-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, openshift-service-mesh/istio-rhel8-operator, +2 more Red Hat AI Inference Server rhaiis/vllm-tpu-rhel9, rhaiis/vllm-spyre-rhel9, rhaiis-preview/vllm-cuda-rhel9
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/de-minimal-rhel8, +16 more
    affected: workaround, no fix available, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel8, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-kserve-storage-initializer-rhel9, rhoai/odh-ml-pipelines-runtime-generic-rhel9, rhoai/odh-training-rocm64-torch28-py312-rhel9, +19 more Red Hat Satellite 6 satellite/iop-insights-engine-rhel9, satellite/iop-vulnerability-engine-rhel9
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat AI Inference Server 3.2 rhaiis 1774351144, rhaiis 1774547384, rhaiis 1775252598
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:6761
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777387242, ansible-automation-platform-26 1777398576, ansible-automation-platform-26/lightspeed-rhel9 1787244079
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:13545
  • Red Hat Ansible Automation Platform 2.18 ansible-automation-platform/ee-minimal-rhel8 1786971288, ansible-automation-platform/ee-minimal-rhel9 1786942232
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:55853
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-hook-runner-rhel8 1783931722
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:41928
  • Red Hat OpenShift AI 2.25 rhoai 1772093278, rhoai 1776247907, rhoai 1776259063, rhoai 1776338381, rhoai 1776349389, rhoai/odh-vllm-cuda-rhel9 1783998774, +2 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:24977
show 3 more
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-26/mcp-tools-rhel9, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-25/controller-rhel8, ansible-automation-platform-24/de-supported-rhel8, +4 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1777410604, ansible-automation-platform 1777410621, ansible-automation-platform-26 1777163004, ansible-automation-platform-26 1777163348, ansible-automation-platform-26 1777163557, ansible-automation-platform-26 1777163594, +52 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532, rhmtc/openshift-migration-openvpn-rhel8 1783914237, rhmtc/openshift-migration-registry-rhel8 1783914276, rhmtc/openshift-migration-rhel8-operator 1783969382, rhmtc/openshift-migration-operator-bundle 1783969793, rhmtc/openshift-migration-controller-rhel8 1783953372, +4 more
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-ta-lmes-job-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-model-registry-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-training-rocm62-torch24-py311-rhel9, +3 more
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 2.25 rhoai 1772093237, rhoai 1772093250, rhoai 1772093252, rhoai 1772093260, rhoai 1772093266, rhoai 1772093272, +286 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi aiohttp
<3.13.3
3.13.3

Affected products

  • aio-libs aiohttp

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.