CVE-2025-53643: aio-libs aiohttp HTTP Request/Response Smuggling
CVSS: 7.5v3.1HighAnalyzed
AliasesSUSE-SU-2025:03057-1SUSE-SU-2025:03201-1GHSA-9548-qrrj-x5pjPYSEC-2026-1104UBUNTU-CVE-2025-53643DEBIAN-CVE-2025-53643CGA-2cgh-2843-xgcmCGA-59g4-32r9-jxfwCGA-8994-vxhq-frhpCGA-9hmq-67q8-vrpcCGA-c2w6-rq49-gj4gCGA-cq9w-qp7r-fm97CGA-jf4q-3c33-x653CGA-m6x4-ph88-3xfcCGA-rvvp-4fvv-jrqxCGA-wgj4-5m4f-q289CGA-2xq5-vp72-gw85CGA-3927-xfqm-9g4hCGA-48qp-6mv8-92fxCGA-55g7-rrjr-7m73CGA-5g6v-6j2c-3ph4CGA-6w34-jqh8-53pxCGA-7x47-3m25-xvfpCGA-8hxg-rhcw-gw6vCGA-8m94-jfmv-h49cCGA-9g65-66f8-w2qfCGA-cjgf-hh78-mp43CGA-f23h-33g8-g598CGA-fjxw-2q9h-652wCGA-hfmr-p54m-xf7xCGA-hh48-44j7-f675CGA-j37h-h729-9x9wCGA-jggr-c73x-4q9jCGA-m74h-cf3p-27w9CGA-r45w-4cpv-whghCGA-whq8-35mg-279cCGA-xvhm-9p86-2rfp
Published 14-07-2025Last modified 15-07-2025
Vulnerability summary
CVE-2025-53643 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in aio-libs aiohttp. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.36%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 14-07-2025PublishedVulnerability first disclosed.
- 15-07-2025Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 1.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:USources6 sources · 1.7–6.3
- OSV · PypiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST1.7LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.04 pp
From 0.31% on 18-09-2026
18-09-202618-10-2026
EPSS score0.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard18 products
- airflow-2-bitnami-compatAll versions (No fix recorded)
- airflow-3< 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
- airflow-core-2< 2.11.0-r4
- airflow-core-2-compat< 2.11.0-r4
Suse7 products
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP3< 3.6.0-150100.3.27.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.6.0-150100.3.27.1 | < 3.9.3-150400.10.33.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 3.6.0-150100.3.27.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 3.6.0-150100.3.27.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP7< 3.6.0-150100.3.27.1
Wolfi5 products
- airflow-3< 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
- dask-kubernetes< 2025.7.0-r1
- py3-cassandra-medusa< 0.24.1-r1
- py3-cassandra-medusa-compat< 0.24.1-r1
Aio-libs1 product
- aiohttp< 3.12.14
Aiohttp1 product
- aiohttp< 3.12.14
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.12.15-1
Opensuse1 product
- python-aiohttp&distro=openSUSE Leap 15.6< 3.9.3-150400.10.33.1
PyPI1 product
- aiohttp< 3.12.14
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
9 vendors · 36 products
References
14 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pjX Refsource CONFIRMWEBREPORTAdvisoryVendor Advisory
- github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6aX Refsource MISCWEBFIXPatch
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE
