CVE-2025-53643
Fixed in a distro release EPSS <1%CVSS 1.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.12.14 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2-bitnami-compat | no fix |
| Chainguard | airflow-3 | 3.2.0-r0 |
| Chainguard | airflow-3-bitnami-compat | no fix |
| Chainguard | airflow-core-2 | 2.11.0-r4 |
| Chainguard | airflow-core-2-compat | 2.11.0-r4 |
| Chainguard | airflow-core-2-oci-entrypoint | 2.11.0-r4 |
| Chainguard | apache-beam-python-3.11-sdk | 2.66.0-r1 |
| Chainguard | dask-kubernetes | 2025.7.0-r1 |
| Chainguard | py3-cassandra-medusa | 0.24.1-r1 |
| Chainguard | py3-cassandra-medusa-compat | 0.24.1-r1 |
| Chainguard | py3-vllm-cuda-12.4 | 0.9.2-r1 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.9.2-r1 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.9.2-r1 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r3 |
| Chainguard | request-1276 | 0.24.1-r3 |
| Chainguard | request-1276-compat | 0.24.1-r3 |
| Chainguard | text-generation-inference | 3.3.6-r3 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | no fix |
| Debian 14 | python-aiohttp | 3.12.15-1 |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.25-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.25-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.27-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.27-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-urllib3 | 0:2.6.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-django | 0:4.2.27-2.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf-debuginfo | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf-debugsource | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.3-2.el10ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.3-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.27-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.27-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-urllib3 | 0:2.6.3-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform developer 2.6 | python3.11-django | 0:4.2.27-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.3-2.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.3-2.el9ap |
| Red Hat satellite 6.18 | python3.12-aiohttp | 0:3.13.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-aiohttp-debuginfo | 0:3.13.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-aiohttp-debugsource | 0:3.13.3-1.el9pc |
| Red Hat satellite 6.18 | python3.12-urllib3 | 0:2.6.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp | 0:3.13.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp-debuginfo | 0:3.13.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-aiohttp-debugsource | 0:3.13.3-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-urllib3 | 0:2.6.3-1.el9pc |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | python-aiohttp | 3.6.0-150100.3.27.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.33.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.27.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.27.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.27.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP7 | python-aiohttp | 3.6.0-150100.3.27.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-aiohttp | 3.9.3-150400.10.33.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-aiohttp | 3.9.3-150400.10.33.1 |
| SUSE Linux Enterprise Server 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| SUSE Linux Enterprise Server 16.0 | python-aiohttp | 3.11.16-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-aiohttp | 3.11.16-160000.3.1 |
| Ubuntu 25.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 22.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 24.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | airflow-3 | 3.2.0-r0 |
| Wolfi | airflow-3-bitnami-compat | no fix |
| Wolfi | dask-kubernetes | 2025.7.0-r1 |
| Wolfi | py3-cassandra-medusa | 0.24.1-r1 |
| Wolfi | py3-cassandra-medusa-compat | 0.24.1-r1 |
| openSUSE Leap 15.6 | python-aiohttp | 3.9.3-150400.10.33.1 |
| openSUSE Leap 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| openSUSE Leap 16.0 | python-aiohttp | 3.11.16-160000.3.1 |