AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

zetlyn/cve-nvd vulnerability cve CVE-2025-69229 cpe cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* known 2026-01-06

https://nvd.nist.gov/vuln/detail/CVE-2025-69229

Properties

cvss	5.3 receipt Source NVD Its words `5.3` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "aiohttp", "vendor": "aio-libs", "versions": [ { "status": "affected", "version": "< 3.13.3" } ] } ], "source": "security-advisories@github.com" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:aiohttp:aiohttp::::::::", "matchCriteriaId": "715B630E-B141-4247-A920-3FFBD8045A05", "versionEndExcluding": "3.13.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3." }, { "lang": "es", "value": "AIOHTTP es un framework HTTP cliente/servidor asíncrono para asyncio y Python. En las versiones 3.13.2 e inferiores, el manejo de mensajes fragmentados puede resultar en un uso excesivo de CPU de bloqueo al recibir un gran número de fragmentos. Si una aplicación utiliza el método request.read() en un punto final, un atacante podría hacer que el servidor dedique una cantidad moderada de tiempo de CPU de bloqueo (por ejemplo, 1 segundo) mientras procesa la solicitud. Esto podría conducir potencialmente a DoS ya que el servidor no podría manejar otras solicitudes durante ese tiempo. Este problema está solucionado en la versión 3.13.3." } ], "id": "CVE-2025-69229", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-69229", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:24:45.403446Z", "version": "2.0.3" } } ] }, "published": "2026-01-06T00:15:48.347", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229" }, { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712" }, { "source": "security-advisories@github.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-770" } ], "source": "security-advisories@github.com", "type": "Secondary" } ] } }
product	aiohttp receipt Source NVD Its words `aiohttp` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "aiohttp", "vendor": "aio-libs", "versions": [ { "status": "affected", "version": "< 3.13.3" } ] } ], "source": "security-advisories@github.com" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:aiohttp:aiohttp::::::::", "matchCriteriaId": "715B630E-B141-4247-A920-3FFBD8045A05", "versionEndExcluding": "3.13.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3." }, { "lang": "es", "value": "AIOHTTP es un framework HTTP cliente/servidor asíncrono para asyncio y Python. En las versiones 3.13.2 e inferiores, el manejo de mensajes fragmentados puede resultar en un uso excesivo de CPU de bloqueo al recibir un gran número de fragmentos. Si una aplicación utiliza el método request.read() en un punto final, un atacante podría hacer que el servidor dedique una cantidad moderada de tiempo de CPU de bloqueo (por ejemplo, 1 segundo) mientras procesa la solicitud. Esto podría conducir potencialmente a DoS ya que el servidor no podría manejar otras solicitudes durante ese tiempo. Este problema está solucionado en la versión 3.13.3." } ], "id": "CVE-2025-69229", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-69229", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:24:45.403446Z", "version": "2.0.3" } } ] }, "published": "2026-01-06T00:15:48.347", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229" }, { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712" }, { "source": "security-advisories@github.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-770" } ], "source": "security-advisories@github.com", "type": "Secondary" } ] } }
status	Analyzed receipt Source NVD Its words `Analyzed` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "aiohttp", "vendor": "aio-libs", "versions": [ { "status": "affected", "version": "< 3.13.3" } ] } ], "source": "security-advisories@github.com" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:aiohttp:aiohttp::::::::", "matchCriteriaId": "715B630E-B141-4247-A920-3FFBD8045A05", "versionEndExcluding": "3.13.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3." }, { "lang": "es", "value": "AIOHTTP es un framework HTTP cliente/servidor asíncrono para asyncio y Python. En las versiones 3.13.2 e inferiores, el manejo de mensajes fragmentados puede resultar en un uso excesivo de CPU de bloqueo al recibir un gran número de fragmentos. Si una aplicación utiliza el método request.read() en un punto final, un atacante podría hacer que el servidor dedique una cantidad moderada de tiempo de CPU de bloqueo (por ejemplo, 1 segundo) mientras procesa la solicitud. Esto podría conducir potencialmente a DoS ya que el servidor no podría manejar otras solicitudes durante ese tiempo. Este problema está solucionado en la versión 3.13.3." } ], "id": "CVE-2025-69229", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-69229", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:24:45.403446Z", "version": "2.0.3" } } ] }, "published": "2026-01-06T00:15:48.347", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229" }, { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712" }, { "source": "security-advisories@github.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-770" } ], "source": "security-advisories@github.com", "type": "Secondary" } ] } }
vendor	aio-libs receipt Source NVD Its words `aio-libs` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "aiohttp", "vendor": "aio-libs", "versions": [ { "status": "affected", "version": "< 3.13.3" } ] } ], "source": "security-advisories@github.com" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:aiohttp:aiohttp::::::::", "matchCriteriaId": "715B630E-B141-4247-A920-3FFBD8045A05", "versionEndExcluding": "3.13.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3." }, { "lang": "es", "value": "AIOHTTP es un framework HTTP cliente/servidor asíncrono para asyncio y Python. En las versiones 3.13.2 e inferiores, el manejo de mensajes fragmentados puede resultar en un uso excesivo de CPU de bloqueo al recibir un gran número de fragmentos. Si una aplicación utiliza el método request.read() en un punto final, un atacante podría hacer que el servidor dedique una cantidad moderada de tiempo de CPU de bloqueo (por ejemplo, 1 segundo) mientras procesa la solicitud. Esto podría conducir potencialmente a DoS ya que el servidor no podría manejar otras solicitudes durante ese tiempo. Este problema está solucionado en la versión 3.13.3." } ], "id": "CVE-2025-69229", "lastModified": "2026-09-30T22:10:00.273", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "security-advisories@github.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-69229", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:24:45.403446Z", "version": "2.0.3" } } ] }, "published": "2026-01-06T00:15:48.347", "references": [ { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229" }, { "source": "security-advisories@github.com", "tags": [ "Patch" ], "url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712" }, { "source": "security-advisories@github.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq" } ], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-770" } ], "source": "security-advisories@github.com", "type": "Secondary" } ] } }

Text

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3. AIOHTTP es un framework HTTP cliente/servidor asíncrono para asyncio y Python. En las versiones 3.13.2 e inferiores, el manejo de mensajes fragmentados puede resultar en un uso excesivo de CPU de bloqueo al recibir un gran número de fragmentos. Si una aplicación utiliza el método request.read() en un punto final, un atacante podría hacer que el servidor dedique una cantidad moderada de tiempo de CPU de bloqueo (por ejemplo, 1 segundo) mientras procesa la solicitud. Esto podría conducir potencialmente a DoS ya que el servidor no podría manejar otras solicitudes durante ese tiempo. Este problema está solucionado en la versión 3.13.3.