PT-2026-1355 · Aiohttp+4 · Aiohttp+4

Published 2026-01-05 · Updated 2026-04-20 · CVE-2025-69229

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below

Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Handling of chunked messages in versions 3.13.2 and below can lead to excessive blocking CPU usage when receiving a large number of chunks. If an application uses the request.read() method in an endpoint, an attacker may be able to cause the server to spend a moderate amount of blocking CPU time, potentially leading to a Denial of Service (DoS) as the server may be unable to handle other requests.

Recommendations Versions prior to 3.13.3 should be updated to version 3.13.3 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

AZL-73512

AZL-73535

BDU:2026-07328

CVE-2025-69229

ECHO-B126-93F5-659C

GHSA-G84X-MCQJ-X9QQ

OESA-2026-1682

OPENSUSE-SU-2026:10025-1

OPENSUSE-SU-2026:20204-1

SUSE-SU-2026:0858-1

SUSE-SU-2026:0859-1

SUSE-SU-2026:20425-1

USN-8032-1

Affected Products

Aiohttp

Debian

Linuxmint

Red Os

Ubuntu

References · 67

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69229.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 · Patch
• https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229 · Patch
• https://osv.dev/vulnerability/CVE-2025-69229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69225 · Security Note
• https://ubuntu.com/security/CVE-2025-69224 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-73535 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69229 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0859-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8032-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-69229 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69229 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-73512 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69229 · Security Note