CVE-2025-69228
Fixed in a distro release EPSS <1%CVSS 6.6
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.13.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.0-r19 |
| Chainguard | airflow-2-bitnami-compat | 2.11.0-r19 |
| Chainguard | airflow-2-compat | 2.11.0-r19 |
| Chainguard | airflow-2-iamguarded-compat | 2.11.0-r19 |
| Chainguard | airflow-3 | 3.2.0-r0 |
| Chainguard | airflow-3 | 3.1.5-r2 |
| Chainguard | airflow-3-bitnami-compat | no fix |
| Chainguard | apache-beam-python-3.11-sdk | 2.70.0-r1 |
| Chainguard | authentik | 2025.10.3-r3 |
| Chainguard | authentik-go-server | 2025.10.3-r3 |
| Chainguard | awx | 24.6.1-r23 |
| Chainguard | checkov | 3.2.499-r0 |
| Chainguard | dask-kubernetes | 2025.7.0-r4 |
| Chainguard | kserve-storage-controller | 0.17.0-r2 |
| Chainguard | kubeflow-pipelines-visualization-server | 2.15.0-r1 |
| Chainguard | open-webui | 0.6.43-r1 |
| Chainguard | py3-cassandra-medusa | 0.26.0-r3 |
| Chainguard | py3-cassandra-medusa-compat | 0.26.0-r3 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.16.0-r1 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.13.0-r3 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.16.0-r1 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r3 |
| Chainguard | request-1276 | 0.27.0-r1 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | 3.11.16-1+deb13u1 |
| Debian 14 | python-aiohttp | 3.13.3-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.32.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.32.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.32.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP7 | python-aiohttp | 3.6.0-150100.3.32.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| SUSE Linux Enterprise Server 16.0 | python-aiohttp | 3.11.16-160000.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-aiohttp | 3.9.3-150400.10.36.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-aiohttp | 3.11.16-160000.3.1 |
| Ubuntu 25.10 | python-aiohttp | 3.11.16-1ubuntu0.1 |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm6 |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm5 |
| Ubuntu Pro 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2+esm2 |
| Ubuntu Pro 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1+esm2 |
| Wolfi | airflow-3 | 3.2.0-r0 |
| Wolfi | airflow-3 | 3.1.5-r2 |
| Wolfi | airflow-3-bitnami-compat | no fix |
| Wolfi | checkov | 3.2.499-r0 |
| Wolfi | dask-kubernetes | 2025.7.0-r4 |
| Wolfi | kserve-storage-controller | 0.17.0-r2 |
| Wolfi | kubeflow-pipelines-visualization-server | 2.15.0-r1 |
| Wolfi | open-webui | 0.6.43-r1 |
| Wolfi | py3-cassandra-medusa | 0.26.0-r3 |
| Wolfi | py3-cassandra-medusa-compat | 0.26.0-r3 |
| openSUSE Leap 15.6 | python-aiohttp | 3.9.3-150400.10.36.1 |
| openSUSE Leap 16.0 | python-Brotli | 1.1.0-160000.3.1 |
| openSUSE Leap 16.0 | python-aiohttp | 3.11.16-160000.3.1 |
| openSUSE Tumbleweed | python-aiohttp | 3.13.3-1.1 |