{"id":"CVE-2025-69226","aliases":["ALPINE-CVE-2025-69226","AZL-73503","AZL-73526","CLSA-2026-1787906503","CLSA-2026-1790748996","CLSA-2026-1791456836","CLSA-2026-1791528872","DEBIAN-CVE-2025-69226","EUVD-2026-1046","GHSA-54jq-c3m8-4m76","MGASA-2026-0584","PYSEC-2026-1097","SUSE-SU-2026:0858-1","SUSE-SU-2026:0859-1","SUSE-SU-2026:20425-1","UBUNTU-CVE-2025-69226","openSUSE-SU-2026:10025-1","openSUSE-SU-2026:20204-1"],"status":"published","title":"AIOHTTP allows for a brute-force leak of internal static filepath components","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00368,"percentile":0.30917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-202","CWE-22"],"published":"2026-01-05T22:52:38Z","modified":"2026-11-09T16:58:28Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.13.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-aiohttp","fixed_in":["3.13.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-aiohttp","fixed_in":["3.13.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"aiohttp","fixed_in":["3.8.5.post19+tuxcare","3.8.4.post16+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-aiohttp","fixed_in":["3.8.4-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-aiohttp","fixed_in":["3.11.16-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiohttp","fixed_in":["3.13.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","fixed_in":["3.0.1-1ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","fixed_in":["3.8.1-4ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","fixed_in":["3.9.1-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-aiohttp","fixed_in":["3.11.16-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.13.2"},{"fixed":"3.13.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.6"},{"fixed":"3.8.6.post10+tuxcare"}]}],"versions":["3.8.6","3.8.6.post1+tuxcare","3.8.6.post2+tuxcare","3.8.6.post3+tuxcare","3.8.6.post4+tuxcare","3.8.6.post5+tuxcare","3.8.6.post6+tuxcare","3.8.6.post7+tuxcare","3.8.6.post8+tuxcare","3.8.6.post9+tuxcare"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1.post15+tuxcare"}]}],"versions":["3.8.1","3.8.1.post1+tuxcare","3.8.1.post10+tuxcare","3.8.1.post11+tuxcare","3.8.1.post12+tuxcare","3.8.1.post13+tuxcare","3.8.1.post14+tuxcare","3.8.1.post2+tuxcare","3.8.1.post3+tuxcare","3.8.1.post4+tuxcare","3.8.1.post5+tuxcare","3.8.1.post6+tuxcare","3.8.1.post7+tuxcare","3.8.1.post8+tuxcare","3.8.1.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.8.5.post19+tuxcare"}]}],"versions":["3.8.5","3.8.5.post1+tuxcare","3.8.5.post10+tuxcare","3.8.5.post11+tuxcare","3.8.5.post12+tuxcare","3.8.5.post13+tuxcare","3.8.5.post14+tuxcare","3.8.5.post15+tuxcare","3.8.5.post16+tuxcare","3.8.5.post17+tuxcare","3.8.5.post18+tuxcare","3.8.5.post2+tuxcare","3.8.5.post3+tuxcare","3.8.5.post4+tuxcare","3.8.5.post5+tuxcare","3.8.5.post6+tuxcare","3.8.5.post7+tuxcare","3.8.5.post8+tuxcare","3.8.5.post9+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.4"},{"fixed":"3.8.4.post16+tuxcare"}]}],"versions":["3.8.4","3.8.4.post1+tuxcare","3.8.4.post10+tuxcare","3.8.4.post11+tuxcare","3.8.4.post12+tuxcare","3.8.4.post13+tuxcare","3.8.4.post14+tuxcare","3.8.4.post15+tuxcare","3.8.4.post2+tuxcare","3.8.4.post3+tuxcare","3.8.4.post4+tuxcare","3.8.4.post5+tuxcare","3.8.4.post6+tuxcare","3.8.4.post7+tuxcare","3.8.4.post8+tuxcare","3.8.4.post9+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u2"}]}],"versions":["3.8.4-1","3.8.4-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-1+deb13u1"}]}],"versions":["3.11.16-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-1"}]}],"versions":["3.11.16-1","3.12.15-1","3.13.0-1","3.13.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.3-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.36.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1","0.17.4-1","0.17.4-1build1","0.20.2-1","0.20.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm6"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4","3.0.1-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-4ubuntu0.2+esm2"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2","3.8.1-4ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.1+esm2"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1","3.9.1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-1ubuntu0.1"}]}],"versions":["3.10.11-1build1","3.11.16-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.3.1"}]}],"bundled":8}],"products":[{"vendor":"aio-libs","product":"aiohttp"},{"vendor":"aiohttp","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-54jq-c3m8-4m76","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-69226","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69226.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69226","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0584.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34938","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/05/14","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8032-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/P3YUGTP2FIH5YJ35RPLSZ7SRKNBOUQ4Z/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8591-1","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.13.4","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.13.5","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.0","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.1","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.2","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.3","tags":["web"]},{"url":"https://pypi.org/project/aiohttp","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256017","tags":["report"]},{"url":"https://bugzilla.suse.com/1256018","tags":["report"]},{"url":"https://bugzilla.suse.com/1256019","tags":["report"]},{"url":"https://bugzilla.suse.com/1256020","tags":["report"]},{"url":"https://bugzilla.suse.com/1256021","tags":["report"]},{"url":"https://bugzilla.suse.com/1256022","tags":["report"]},{"url":"https://bugzilla.suse.com/1256023","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69229","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260859-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254867","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620425-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246517","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53643","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-69226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69226","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69230","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-69226","title":"AIOHTTP allows for a brute-force leak of internal static filepath components","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T22:52:38.467Z","modified":"2026-01-06T19:03:21.505Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2026-1046","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T22:52:38Z","modified":"2026-01-06T19:03:21Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:55.49901Z"}],"ghsa":[{"id":"GHSA-54jq-c3m8-4m76","title":"AIOHTTP vulnerable to brute-force leak of internal static file path components","description":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","status":"published","published":"2026-01-05T23:09:51Z","modified":"2026-01-06T16:06:50Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-22","CWE-202"],"updated_at":"2026-11-02T14:39:16.156387Z"}],"nvd":[{"id":"CVE-2025-69226","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:40.913Z","modified":"2026-10-11T20:10:00.2Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:11:55.613137Z"}],"osv":[{"id":"ALPINE-CVE-2025-69226","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:40.913Z","modified":"2026-11-03T06:32:34.133753503Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2025-69226","title":"AIOHTTP allows for a brute-force leak of internal static filepath components","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T22:52:38.467Z","modified":"2026-10-28T02:30:50.787619607Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-69226","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:40.913Z","modified":"2026-11-01T00:00:07.509813684Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-54jq-c3m8-4m76","title":"AIOHTTP vulnerable to brute-force leak of internal static file path components","description":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","status":"published","published":"2026-01-05T23:09:51Z","modified":"2026-09-10T03:50:32.751498447Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-202","CWE-22"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"PYSEC-2026-1097","title":"AIOHTTP vulnerable to brute-force leak of internal static file path components","description":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","status":"published","published":"2026-07-07T16:03:15.61125Z","modified":"2026-07-07T17:46:18.706941624Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-69226","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:00Z","modified":"2026-07-23T01:15:15.475788063Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-73503","title":"CVE-2025-69226 affecting package python-aiohttp 3.6.2-3","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:40Z","modified":"2026-04-21T04:33:54.539937Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"AZL-73526","title":"CVE-2025-69226 affecting package python-aiohttp 3.6.2-3","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","status":"published","published":"2026-01-05T23:15:40Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"CLSA-2026-1787906503","title":"TuxCare security update for aiohttp (8 CVEs)","description":"TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.","status":"published","published":"2026-08-28T08:41:43Z","modified":"2026-10-22T14:31:00.003231976Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790748996","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post15+tuxcare.","status":"published","published":"2026-09-30T06:16:36Z","modified":"2026-10-15T09:48:02.387595673Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791456836","title":"TuxCare security update for aiohttp (1 CVE)","description":"TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post19+tuxcare.","status":"published","published":"2026-10-08T10:53:56Z","modified":"2026-10-15T09:48:02.365621764Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791528872","title":"TuxCare security update for aiohttp (1 CVE)","description":"TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post16+tuxcare.","status":"published","published":"2026-10-09T06:54:32Z","modified":"2026-10-15T09:47:40.981631751Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2026-0584","title":"Updated python-aiohttp package fixes security vulnerabilities","description":"Please see the links for additional information about the\nvulnerabilities and changes performed by developers since the version\n3.13.3.\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-09T16:58:28.023379647Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"openSUSE-SU-2026:10025-1","title":"python311-aiohttp-3.13.3-1.1 on GA media","description":"These are all security issues fixed in the python311-aiohttp-3.13.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-09T00:00:00Z","modified":"2026-03-23T04:54:21.571454Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20204-1","title":"Security update for python-aiohttp, python-Brotli","description":"This update for python-aiohttp, python-Brotli fixes the following issues:\n\nChanges in python-aiohttp:\n\n- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).\n- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).\n- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).\n- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).\n- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).\n- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).\n- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).\n- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).\n\nChanges in python-Brotli:\n\n- Add max length decompression (bsc#1254867, bsc#1256017).\n","status":"published","published":"2026-02-12T14:01:04Z","modified":"2026-03-23T04:54:47.85306Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0858-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues:\n\n- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).\n- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).\n- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).\n- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).\n- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).\n- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).\n- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).\n","status":"published","published":"2026-03-10T12:38:39Z","modified":"2026-03-13T06:42:21.131243Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0859-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues:\n  \n- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).\n- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).\n- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).\n- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).\n- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).\n- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).\n- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).\n","status":"published","published":"2026-03-10T16:05:00Z","modified":"2026-03-13T19:47:39.492283Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20425-1","title":"Security update for python-aiohttp, python-Brotli","description":"This update for python-aiohttp, python-Brotli fixes the following issues:\n\nChanges in python-aiohttp:\n\n- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).\n- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).\n- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).\n- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).\n- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).\n- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).\n- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).\n- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).\n\nChanges in python-Brotli:\n\n- Add max length decompression (bsc#1254867, bsc#1256017).\n","status":"published","published":"2026-02-12T13:59:27Z","modified":"2026-03-23T04:52:53.669218Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}