PT-2025-29512 · Aiohttp+4 · Aiohttp+4

Jeppw · Published 2025-07-14 · Updated 2026-03-11 · CVE-2025-53643

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: AIOHTTP versions prior to 3.12.14

Description: AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, contains an issue where the Python parser does not correctly parse trailer sections of an HTTP request. This can allow an attacker to execute a request smuggling attack, potentially bypassing firewalls or proxy protections, when a pure Python version of AIOHTTP is installed or AIOHTTP NO EXTENSIONS is enabled.

Recommendations: Upgrade to AIOHTTP version 3.12.14 or later.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

AZL-65252

AZL-65256

BDU:2025-15590

CVE-2025-53643

ECHO-1E61-9041-EA81

GHSA-9548-QRRJ-X5PJ

OPENSUSE-SU-2026:20204-1

RHSA-2026:1249

RHSA-2026:1506

RHSA-2026:2760

SUSE-SU-2025:03057-1

SUSE-SU-2025:03201-1

SUSE-SU-2025_03057-1

SUSE-SU-2025_03201-1

SUSE-SU-2026:20425-1

Affected Products

Aiohttp

Alt Linux

Debian

Red Os

Suse

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53643.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20425-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-53643 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03057-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20204-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53643 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15590 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53643 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-65256 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53643 · Security Note
• https://osv.dev/vulnerability/AZL-65252 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53643 · Vendor Advisory