PT-2026-1354 · Aiohttp+4 · Aiohttp+4

Published 2026-01-05 · Updated 2026-04-20 · CVE-2025-69228

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below

Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below are susceptible to a denial of service condition. An attacker can craft a request that causes an AIOHTTP server to experience uncontrolled memory consumption during processing. Specifically, if an application uses the Request.post() method within a handler, an attacker may be able to freeze the server by exhausting its memory.

Recommendations Update AIOHTTP to version 3.13.3 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

AZL-73509

AZL-73532

BDU:2026-07270

CVE-2025-69228

ECHO-EC36-3803-B3EB

GHSA-6JHG-HG63-JVVF

OESA-2026-1682

OPENSUSE-SU-2026:10025-1

OPENSUSE-SU-2026:20204-1

SUSE-SU-2026:0858-1

SUSE-SU-2026:0859-1

SUSE-SU-2026:20425-1

USN-8032-1

Affected Products

Aiohttp

Debian

Linuxmint

Red Os

Ubuntu

References · 64

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69228.json · Exploit
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf · Patch
• https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10025-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69227 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jhg-hg63-jvvf · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8032-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69228 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69228 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8032-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20425-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69228 · Security Note
• https://ubuntu.com/security/CVE-2025-69226 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69228 · Vendor Advisory