CVE-2025-69228: aio-libs aiohttp
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-6jhg-hg63-jvvfPYSEC-2026-1100UBUNTU-CVE-2025-69228DEBIAN-CVE-2025-69228CGA-2x8p-89xg-2gmmCGA-474g-xc8q-3hrwCGA-4xrw-75c9-c7q8CGA-6r7h-fp58-h8fcCGA-79mm-38jf-95ffCGA-7cwh-g55x-6h97CGA-7vxv-rc4f-8rq8CGA-9gmj-82pg-xv6vCGA-g38g-49g5-69fpCGA-g747-f262-9gx2CGA-gq3m-vgr6-28jfCGA-gw7g-mcmj-p8q2CGA-m3q2-2w95-2m9pCGA-m9pj-xfj8-f6xwCGA-p8vf-458c-3662CGA-q7x2-58gp-r8grCGA-v293-m944-7rj8CGA-x2c7-3xfv-c2mqCGA-37c4-m78q-9px4CGA-43fx-47r8-qr5fCGA-4xmg-88rp-c9j2CGA-5hr4-2chw-qp52CGA-7cxx-gg76-c8hgCGA-7j3m-286w-ph4hCGA-7xpc-j49w-7v5wCGA-cpp6-4vg4-64j4CGA-fmmf-j7xq-xf93CGA-fq3r-pvrx-q5wpCGA-ggcv-52pp-pccjCGA-h8x8-cqpj-rx3fCGA-hfph-h8f9-8r48CGA-pf8q-55qv-jrwxCGA-q3r7-h8wg-rj9rCGA-q3vx-qcmp-92q9CGA-qm88-8657-3w7rCGA-v223-5p4j-9wxgCGA-wmrj-w556-r62pCGA-x63v-r78q-jj77CGA-xm94-3jgg-cv5p
Published 05-01-2026Last modified 06-01-2026
Vulnerability summary
CVE-2025-69228 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.41%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 7Timeline
- 05-01-2026PublishedVulnerability first disclosed.
- 06-01-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:USources6 sources · 6.6–8.7
- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.01 pp
From 0.40% on 19-09-2026
19-09-202619-10-2026
EPSS score0.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard22 products
- airflow-2< 2.11.0-r19
- airflow-2-bitnami-compat< 2.11.0-r19
- airflow-2-compat< 2.11.0-r19
- airflow-2-iamguarded-compat< 2.11.0-r19
- airflow-3< 3.1.5-r2 | < 3.2.0-r0
Wolfi9 products
- airflow-3< 3.1.5-r2 | < 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
- checkov< 3.2.499-r0
- dask-kubernetes< 2025.7.0-r4
- kserve-storage-controller< 0.17.0-r2
Aio-libs1 product
- aiohttp< 3.13.3
Aiohttp1 product
- aiohttp< 3.13.3
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.11.16-1+deb13u1 | < 3.13.3-1
PyPI1 product
- aiohttp< 3.13.3
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded) | < 3.0.1-1ubuntu0.1~esm6 | < 3.8.1-4ubuntu0.2+esm2 | < 3.9.1-1ubuntu0.1+esm2 | < 3.11.16-1ubuntu0.1
7 vendors · 36 products
References
11 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvfX Refsource CONFIRMWEBREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60X Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE
