CVE-2025-69227: aio-libs aiohttp Infinite Loop
Vulnerability summary
CVE-2025-69227 is a high (CVSS 7.5) Infinite Loop vulnerability in aio-libs aiohttp. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 7Timeline
- 05-01-2026PublishedVulnerability first disclosed.
- 06-01-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
+0.01 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard22 products
- airflow-2< 2.11.0-r19
- airflow-2-bitnami-compat< 2.11.0-r19
- airflow-2-compat< 2.11.0-r19
- airflow-2-iamguarded-compat< 2.11.0-r19
- airflow-3< 3.2.0-r0 | < 3.1.5-r2
Wolfi9 products
- airflow-3< 3.2.0-r0 | < 3.1.5-r2
- airflow-3-bitnami-compatAll versions (No fix recorded)
- checkov< 3.2.499-r0
- dask-kubernetes< 2025.7.0-r4
- kserve-storage-controller< 0.17.0-r2
Aio-libs1 product
- aiohttp< 3.13.3
Aiohttp1 product
- aiohttp< 3.13.3
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.11.16-1+deb13u1 | < 3.13.3-1
PyPI1 product
- aiohttp< 3.13.3
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.1-4ubuntu0.2+esm2 | < 3.9.1-1ubuntu0.1+esm2 | < 3.11.16-1ubuntu0.1
7 vendors · 36 products
References
11 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23X Refsource CONFIRMWEBREPORTAdvisoryVendor Advisory
- github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259X Refsource MISCWEBREPORTFIXPatch
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE
