Medium severity · published Jan 5, 2026
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.13.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69229
Patch
https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
Patch
https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
Patch
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect