CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
AIOHTTP vulnerable to DoS through chunked messages
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69229- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-1043
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
EUVD-2026-1043- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g84x-mcqj-x9qq
AIOHTTP vulnerable to DoS through chunked messages
Summary
Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.
Impact
If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.
Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
- Record
GHSA-g84x-mcqj-x9qq- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69229- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-69229
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
ALPINE-CVE-2025-69229- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
OSV
AIOHTTP vulnerable to DoS through chunked messages
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69229- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 17 moreShow less
OSVDEBIAN-CVE-2025-69229
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
DEBIAN-CVE-2025-69229- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-g84x-mcqj-x9qq
AIOHTTP vulnerable to DoS through chunked messages
Summary
Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.
Impact
If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.
Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
- Record
GHSA-g84x-mcqj-x9qq- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVOESA-2026-1682
python-aiohttp security update
Async http client/server framework (asyncio).
Security Fix(es):
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.(CVE-2025-69225)
aiohttp contains a denial-of-service vulnerability when bypassing asserts, allowing attackers to bypass assertion checks through specific methods leading to service unavailability.(CVE-2025-69227)
aiohttp contains a vulnerability when processing large payloads. An attacker can craft large requests to exhaust server resources, leading to denial of service.(CVE-2025-69228)
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of small chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g., 1 second) while processing the request. This could potentially lead to a Denial of Service (DoS) as the server would be unable to handle other requests during that time.(CVE-2025-69229)
- Record
OESA-2026-1682- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVPYSEC-2026-1106
AIOHTTP vulnerable to DoS through chunked messages
Summary
Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.
Impact
If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.
Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
- Record
PYSEC-2026-1106- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-69229
CVE-2025-69229 in aiohttp - Patched by Root
Root has patched CVE-2025-69229 in the aiohttp package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-69229- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69229
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
UBUNTU-CVE-2025-69229- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-73512 No score
CVE-2025-69229 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
AZL-73512- Updated
- 2026-11-02
OSVAZL-73535 No score
CVE-2025-69229 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
- Record
AZL-73535- Updated
- 2026-11-05
OSVCLSA-2026-1787906503 No score
TuxCare security update for aiohttp (8 CVEs)
TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.
- Record
CLSA-2026-1787906503- Updated
- 2026-11-02
OSVCLSA-2026-1788792738 No score
TuxCare security update for aiohttp (9 CVEs)
TuxCare rebuilt aiohttp to address 9 CVEs. Fixed in 3.8.4.post8+tuxcare.
- Record
CLSA-2026-1788792738- Updated
- 2026-11-02
OSVCLSA-2026-1788866911 No score
TuxCare security update for aiohttp (6 CVEs)
TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare.
- Record
CLSA-2026-1788866911- Updated
- 2026-11-02
OSVCLSA-2026-1789132119 No score
TuxCare security update for aiohttp (6 CVEs)
TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.1.post13+tuxcare.
- Record
CLSA-2026-1789132119- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10025-1 No score
python311-aiohttp-3.13.3-1.1 on GA media
These are all security issues fixed in the python311-aiohttp-3.13.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10025-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20204-1 No score
Security update for python-aiohttp, python-Brotli
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).
Changes in python-Brotli:
- Add max length decompression (bsc#1254867, bsc#1256017).
- Record
openSUSE-SU-2026:20204-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0858-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- Record
SUSE-SU-2026:0858-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0859-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- Record
SUSE-SU-2026:0859-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20425-1 No score
Security update for python-aiohttp, python-Brotli
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).
Changes in python-Brotli:
- Add max length decompression (bsc#1254867, bsc#1256017).
- Record
SUSE-SU-2026:20425-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aiohttpPyPI |
through 3.13.2 | 3.13.3 |
py3-aiohttpAlpine:v3.23 |
before 3.13.3-r0 | 3.13.3-r0 |
py3-aiohttpAlpine:v3.24 |
before 3.13.3-r0 | 3.13.3-r0 |
python-aiohttpAzure Linux:2 |
through 3.6.2-3 | None known |
python-aiohttpAzure Linux:3 |
through 3.6.2-3 | None known |
aiohttpTuxCare:PyPI From an advisory covering 8 CVEs |
3.8.6 up to 3.8.6.post10+tuxcare, plus listed versions 3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare Show 4 moreShow less3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare |
3.8.6.post10+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 9 CVEs |
3.8.4 up to 3.8.4.post8+tuxcare, plus listed versions 3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare |
3.8.4.post8+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 6 CVEs |
3.8.5 up to 3.8.5.post12+tuxcare, plus listed versions 3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare Show 6 moreShow less3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare |
3.8.5.post12+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 6 CVEs |
3.8.1 up to 3.8.1.post13+tuxcare, plus listed versions 3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post2+tuxcare Show 7 moreShow less3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare |
3.8.1.post13+tuxcare |
python-aiohttpDebian:12 |
before 3.8.4-1+deb12u2, plus listed versions 3.8.4-13.8.4-1+deb12u1 |
3.8.4-1+deb12u2 |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-aiohttpDebian:13 |
before 3.11.16-1+deb13u1, plus listed versions 3.11.16-1 |
3.11.16-1+deb13u1 |
python-aiohttpDebian:14 |
before 3.13.3-1, plus listed versions 3.11.16-13.12.15-13.13.0-13.13.1-1 |
3.13.3-1 |
aiohttpPyPI |
before 3.13.3, plus listed versions 0.10.10.00.10.10.10.20.11.0 Show 45 moreShow less0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2 |
3.13.3 |
python-aiohttpopenEuler:24.03-LTS-SP1 From an advisory covering 4 CVEs |
before 3.9.3-9.oe2403sp1 | 3.9.3-9.oe2403sp1 |
python-aiohttpopenEuler:24.03-LTS-SP2 From an advisory covering 4 CVEs |
before 3.9.3-9.oe2403sp2 | 3.9.3-9.oe2403sp2 |
python-aiohttpopenEuler:24.03-LTS-SP3 From an advisory covering 4 CVEs |
before 3.9.3-9.oe2403sp3 | 3.9.3-9.oe2403sp3 |
python-aiohttpopenEuler:20.03-LTS-SP4 From an advisory covering 4 CVEs |
before 3.7.4-6.oe2003sp4 | 3.7.4-6.oe2003sp4 |
python-aiohttpopenEuler:22.03-LTS-SP4 From an advisory covering 4 CVEs |
before 3.7.4-7.oe2203sp4 | 3.7.4-7.oe2203sp4 |
python-aiohttpopenEuler:24.03-LTS From an advisory covering 4 CVEs |
before 3.9.3-9.oe2403 | 3.9.3-9.oe2403 |
aiohttpRoot:PyPI |
before 3.9.1+aikido.7 | 3.9.1+aikido.73.10.11+aikido.43.10.11+aikido.53.10.11+aikido.63.10.11+aikido.73.12.14+aikido.33.12.15+aikido.63.10.11+aikido.83.12.14+aikido.43.12.14+aikido.53.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.8.6+aikido.103.10.11+aikido.93.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.8.6+aikido.133.9.1+aikido.83.12.14+aikido.83.12.15+aikido.73.10.11+aikido.103.12.15+aikido.83.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.9.1+aikido.93.12.15+aikido.93.12.14+aikido.93.8.6+aikido.15 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Module for Python 3 15 SP7 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpopenSUSE:Leap 15.6 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-BrotliSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
python-BrotliSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
python-aiohttpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1 |
None known |
python-aiohttpUbuntu:Pro:18.04:LTS |
before 3.0.1-1ubuntu0.1~esm6, plus listed versions 2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm13.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm5 |
3.0.1-1ubuntu0.1~esm6 |
python-aiohttpUbuntu:Pro:22.04:LTS |
before 3.8.1-4ubuntu0.2+esm2, plus listed versions 3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build13.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm1 |
3.8.1-4ubuntu0.2+esm2 |
python-aiohttpUbuntu:Pro:24.04:LTS |
before 3.9.1-1ubuntu0.1+esm2, plus listed versions 3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm1 |
3.9.1-1ubuntu0.1+esm2 |
python-aiohttpUbuntu:25.10 |
before 3.11.16-1ubuntu0.1, plus listed versions 3.10.11-1build13.11.16-1 |
3.11.16-1ubuntu0.1 |
python-aiohttpopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 3.13.3-1.1 | 3.13.3-1.1 |
python-BrotliopenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpopenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69229 is a medium vulnerability (CVSS 6.6) in Aio-libs Aiohttp, published January 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in aiohttp 3.13.3.
References
github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq
nvd.nist.gov/vuln/detail/CVE-2025-69229
security.alpinelinux.org/vuln/CVE-2025-69229
Show 32 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69229
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1682
pypi.org/project/aiohttp
suse.com/support/update/announcement/2026/suse-su-20260858-1
bugzilla.suse.com/1256017
ubuntu.com/security/CVE-2025-69229
cve.org/CVERecord?id=CVE-2025-69229
Left out here: 253 versions. The JSON record has them.