Every CVE Search/ Get API key

CVE-2025-53643

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

1.7 LowFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.36%Up 0.3 points since Jul 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 1.7

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
CVE-2025-53643
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2025-21384 1.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
EUVD-2025-21384
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-9548-qrrj-x5pj 1.7

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary

The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

Record
GHSA-9548-qrrj-x5pj
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
NVD 1.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
CVE-2025-53643
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
OSV 1.7

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
CVE-2025-53643
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
OSVDEBIAN-CVE-2025-53643 7.5

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
DEBIAN-CVE-2025-53643
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 17 moreShow less
OSVGHSA-9548-qrrj-x5pj 1.7

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary

The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

Record
GHSA-9548-qrrj-x5pj
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
OSVPYSEC-2026-1104 1.7

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary

The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

Record
PYSEC-2026-1104
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
OSVRHSA-2026:1249 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:1249
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:1506 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:1506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:2760 7.5

Red Hat Security Advisory: Satellite 6.18.3 Async Update

Record
RHSA-2026:2760
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-53643 7.5

CVE-2025-53643 in aiohttp - Patched by Root

Root has patched CVE-2025-53643 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-53643
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-53643 1.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
UBUNTU-CVE-2025-53643
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-65252 No score

CVE-2025-53643 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
AZL-65252
Updated
2026-11-05
OSVAZL-65256 No score

CVE-2025-53643 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Record
AZL-65256
Updated
2026-11-02
OSVCLSA-2026-1773101685 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post5+tuxcare.

Record
CLSA-2026-1773101685
Updated
2026-11-02
OSVCLSA-2026-1787906503 No score

TuxCare security update for aiohttp (8 CVEs)

TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.

Record
CLSA-2026-1787906503
Updated
2026-11-02
OSVCLSA-2026-1788866911 No score

TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare.

Record
CLSA-2026-1788866911
Updated
2026-11-02
OSVCLSA-2026-1789379698 No score

TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post9+tuxcare.

Record
CLSA-2026-1789379698
Updated
2026-11-02
OSVopenSUSE-SU-2026:20204-1 No score

Security update for python-aiohttp, python-Brotli

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
  • CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

  • Add max length decompression (bsc#1254867, bsc#1256017).
Record
openSUSE-SU-2026:20204-1
Updated
2026-11-02
OSVSUSE-SU-2025:03057-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517)
Record
SUSE-SU-2025:03057-1
Updated
2026-11-02
OSVSUSE-SU-2025:03201-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2025-53643: request smuggling vulnerability due to incorrect parsing trailer sections of an HTTP request (bsc#1246517).
Record
SUSE-SU-2025:03201-1
Updated
2026-11-02
OSVSUSE-SU-2026:20425-1 No score

Security update for python-aiohttp, python-Brotli

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
  • CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

  • Add max length decompression (bsc#1254867, bsc#1256017).
Record
SUSE-SU-2026:20425-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 before 3.12.14
3.12.14
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
python-aiohttp
Azure Linux:2
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.1 up to 3.8.1.post5+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare
3.8.1.post5+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 8 CVEs
 3.8.6 up to 3.8.6.post10+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare
Show 4 moreShow less
3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare
3.8.6.post10+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 6 CVEs
 3.8.5 up to 3.8.5.post12+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare
Show 6 moreShow less
3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post12+tuxcare
aiohttp
TuxCare:PyPI
 3.8.4 up to 3.8.4.post9+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare3.8.4.post8+tuxcare
3.8.4.post9+tuxcare
python-aiohttp
Debian:12
 before 3.8.4-1+deb12u2, plus listed versions
3.8.4-13.8.4-1+deb12u1
3.8.4-1+deb12u2
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 before 3.12.15-1, plus listed versions
3.11.16-1
3.12.15-1
Show 60 moreShow less
Affected packages
PackageAffectedFixed
aiohttp
PyPI
 before 3.12.14, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.12.14
python3.11-protobuf
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.25.8-1.el9ap
0:4.25.8-1.el9ap
python3.11-protobuf-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.25.8-1.el9ap
0:4.25.8-1.el9ap
python3.11-protobuf-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.25.8-1.el9ap
0:4.25.8-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.7.8-1.el9ap
0:4.7.8-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 6 CVEs
 before 0:1.6.3-2.el10ap
0:1.6.3-2.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 6 CVEs
 before 0:1.6.3-2.el9ap
0:1.6.3-2.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 6 CVEs
 before 0:1.6.3-2.el9ap
0:1.6.3-2.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:1.6.3-2.el9ap
0:1.6.3-2.el9ap
python3.11-django
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.2.27-2.el9ap
0:4.2.27-2.el9ap
python3.11-django
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:4.2.27-2.el9ap
0:4.2.27-2.el9ap
python3.11-urllib3
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 6 CVEs
 before 0:2.6.3-1.el9ap
0:2.6.3-1.el9ap
python3.11-urllib3
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 6 CVEs
 before 0:2.6.3-1.el9ap
0:2.6.3-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:4.6.25-1.el8ap
0:4.6.25-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:4.6.25-1.el9ap
0:4.6.25-1.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el8ap
0:1.6.3-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el8ap
0:1.6.3-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el8ap
0:1.6.3-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el9ap
0:1.6.3-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el9ap
0:1.6.3-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el9ap
0:1.6.3-1.el9ap
python3.11-django
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 5 CVEs
 before 0:4.2.27-1.el8ap
0:4.2.27-1.el8ap
python3.11-django
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:4.2.27-1.el8ap
0:4.2.27-1.el8ap
python3.11-django
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 5 CVEs
 before 0:4.2.27-1.el9ap
0:4.2.27-1.el9ap
python3.11-django
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:4.2.27-1.el9ap
0:4.2.27-1.el9ap
python3.11-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 5 CVEs
 before 0:2.6.3-1.el8ap
0:2.6.3-1.el8ap
python3.11-urllib3
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:2.6.3-1.el8ap
0:2.6.3-1.el8ap
python3.11-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 5 CVEs
 before 0:2.6.3-1.el9ap
0:2.6.3-1.el9ap
python3.11-urllib3
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:2.6.3-1.el9ap
0:2.6.3-1.el9ap
python3.12-aiohttp
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-aiohttp
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:3.13.3-1.el9pc
0:3.13.3-1.el9pc
python3.12-urllib3
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el9pc
0:2.6.3-1.el9pc
python3.12-urllib3
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el9pc
0:2.6.3-1.el9pc
aiohttp
Root:PyPI
 before 3.10.11+aikido.3
3.10.11+aikido.33.9.1+aikido.73.12.13+aikido.33.10.11+aikido.43.8.6+aikido.13.10.11+aikido.53.10.11+aikido.63.10.11+aikido.73.8.6+aikido.23.8.6+aikido.33.10.11+aikido.83.8.6+aikido.43.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.8.6+aikido.103.10.11+aikido.93.8.6+aikido.113.8.6+aikido.123.8.6+aikido.133.9.1+aikido.83.12.13+aikido.43.10.11+aikido.103.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.12.13+aikido.53.9.1+aikido.93.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.9.3-150400.10.33.1
3.9.3-150400.10.33.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP6
 before 3.9.3-150400.10.33.1
3.9.3-150400.10.33.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
 before 3.9.3-150400.10.33.1
3.9.3-150400.10.33.1
python-aiohttp
openSUSE:Leap 15.6
 before 3.9.3-150400.10.33.1
3.9.3-150400.10.33.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
 before 3.6.0-150100.3.27.1
3.6.0-150100.3.27.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.6.0-150100.3.27.1
3.6.0-150100.3.27.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.6.0-150100.3.27.1
3.6.0-150100.3.27.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 3.6.0-150100.3.27.1
3.6.0-150100.3.27.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 3.6.0-150100.3.27.1
3.6.0-150100.3.27.1
python-Brotli
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1
python-Brotli
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:25.10
 All versions, plus listed versions
3.10.11-1build13.11.16-13.11.16-1ubuntu0.1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known
python-Brotli
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53643 is a low vulnerability (CVSS 1.7) in Aio-libs Aiohttp, published July 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in aiohttp 3.12.14.

References

Show 87 moreShow less
This page doesn't list everything

Left out here: 248 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open