SB2026031147 - Anolis OS update for python-aiohttp
Published: March 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Improper handling of highly compressed data (CVE-ID: CVE-2025-69223)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the application does not properly handle highly compressed data within the auto_decompress feature. A remote attacker can send a specially crafted compressed HTTP request to the server and consume all available memory resources.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-69224)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of non-ASCII characters within HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks but requires that a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled.
3) Information disclosure (CVE-ID: CVE-2025-69226)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the web.static() function allows detection of existing path components. A remote non-authenticated attacker can brute-force file names on the system.
4) Resource exhaustion (CVE-ID: CVE-2025-69229)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the request.read() method. A remote attacker can trigger CPU exhaustion and perform a denial of service (DoS) attack.
5) Resource management error (CVE-ID: CVE-2025-69230)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when reading invalid cookie attributes. A remote attacker can send specially crafted requests to the application and produce a huge amount of log entries, leading to a denial of service condition.
Remediation
Install update from vendor's website.