Resource exhaustion in Aio-libs Aiohttp
CVE-2025-69229
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an applicatio…
EPSS: 0.000 (14.6th percentile) — read the EPSS interpretation.
Affected products
- Aio-libs Aiohttp — versions < 3.13.3
Weakness classification (CWE)
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq (x_refsource_CONFIRM)
- https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229 (x_refsource_MISC)
- https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 (x_refsource_MISC)