CVE-2025-69227

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

Summary

When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.

Impact

If optimisations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message.

Patch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259

Async http client/server framework (asyncio).

Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.(CVE-2025-69225)

aiohttp contains a denial-of-service vulnerability when bypassing asserts, allowing attackers to bypass assertion checks through specific methods leading to service unavailability.(CVE-2025-69227)

aiohttp contains a vulnerability when processing large payloads. An attacker can craft large requests to exhaust server resources, leading to denial of service.(CVE-2025-69228)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of small chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g., 1 second) while processing the request. This could potentially lead to a Denial of Service (DoS) as the server would be unable to handle other requests during that time.(CVE-2025-69229)

Summary

When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.

Impact

If optimisations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message.

Patch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259

Root has patched CVE-2025-69227 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.

TuxCare rebuilt aiohttp to address 9 CVEs. Fixed in 3.8.4.post8+tuxcare.

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare.

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.1.post13+tuxcare.

These are all security issues fixed in the python311-aiohttp-3.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

• CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
• CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
• CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
• CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
• CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
• CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
• CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
• CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

• Add max length decompression (bsc#1254867, bsc#1256017).

This update for python-aiohttp fixes the following issues:

• CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
• CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
• CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
• CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
• CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
• CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
• CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).

This update for python-aiohttp fixes the following issues:

• CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
• CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
• CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
• CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
• CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
• CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
• CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

• CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
• CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
• CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
• CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
• CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
• CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
• CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
• CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

• Add max length decompression (bsc#1254867, bsc#1256017).