SB2026010643 - Multiple vulnerabilities in aiohttp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026010643

SB2026010643 - Multiple vulnerabilities in aiohttp

Published: January 6, 2026

Security Bulletin ID SB2026010643
Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2025-69229)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the request.read() method. A remote attacker can trigger CPU exhaustion and perform a denial of service (DoS) attack.


2) Resource management error (CVE-ID: CVE-2025-69230)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when reading invalid cookie attributes. A remote attacker can send specially crafted requests to the application and produce a huge amount of log entries, leading to a denial of service condition. 


3) Resource exhaustion (CVE-ID: CVE-2025-69228)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Request.post() method. A remote attacker can send large HTTP payloads to the application to trigger resource exhaustion and perform a denial of service (DoS) attack.


4) Infinite loop (CVE-ID: CVE-2025-69227)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the Request.post() method when optimisations are enabled (-O or PYTHONOPTIMIZE=1). A remote attacker send multiple HTTP POST requests to the server and perform a denial of service attack.


5) Information disclosure (CVE-ID: CVE-2025-69226)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the web.static() function allows detection of existing path components. A remote non-authenticated attacker can brute-force file names on the system. 


6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-69225)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to the application allows non-ASCII decimals to be present in the Range header. A remote attacker can send a specially crafted HTTP request to the server and potentially smuggle arbitrary HTTP headers.



7) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-69224)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of non-ASCII characters within HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks but requires that a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled.


8) Improper handling of highly compressed data (CVE-ID: CVE-2025-69223)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the application does not properly handle highly compressed data within the auto_decompress feature. A remote attacker can send a specially crafted compressed HTTP request to the server and consume all available memory resources. 


Remediation

Install update from vendor's website.

References