Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
1.7
CVE-2025-53643: aiohttp library update stops possible attacker takeover
CVE-2025-53643 · published 13 days ago
Summary
The aiohttp web‑framework used in several Python packages has been found to contain a security weakness that could let an attacker run code on your server. Updated versions of aiohttp from the official releases and the Debian, Canonical, and RootIO packages fix the issue. Upgrade all aiohttp installations to the latest version as soon as possible.
What to do
- Update aiohttp team aiohttp to version 3.12.14.
- Update rootio-aiohttp to version 3.10.11+root.io.2.
- Update debian python-aiohttp to version 3.7.4-1+deb11u2.
- Update aiohttp team aiohttp to version 3.10.11+aikido.4.
- Update rootio-aiohttp to version 3.10.11+root.io.4.
- Update aiohttp team aiohttp to version 3.10.11+aikido.5.
- Update rootio-aiohttp to version 3.10.11+root.io.5.
- Update aiohttp team aiohttp to version 3.10.11+aikido.7.
- Update rootio-aiohttp to version 3.10.11+root.io.7.
- Update rootio-aiohttp to version 3.8.6+root.io.3.
- Update rootio-aiohttp to version 3.10.11+root.io.8.
- Update rootio-aiohttp to version 3.8.6+root.io.4.
- Update rootio-aiohttp to version 3.8.6+root.io.5.
- Update rootio-aiohttp to version 3.8.6+root.io.7.
- Update rootio-aiohttp to version 3.8.6+root.io.8.
- Update rootio-aiohttp to version 3.8.6+root.io.9.
- Update aiohttp team aiohttp to version 3.8.6+aikido.11.
- Update rootio-aiohttp to version 3.8.6+root.io.10.
- Update debian python-aiohttp to version 3.12.15-1.
- Update rootio-aiohttp to version 3.12.13+root.io.3.
- Update aiohttp team aiohttp to version 3.12.13+aikido.3.
- Update aiohttp team aiohttp to version 3.8.6+aikido.12.
- Update aiohttp to version 3.10.11+aikido.11.
- Update aiohttp to version 3.9.1+aikido.9.
- Update aiohttp aiohttp to version 3.12.14 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | aiohttp team | aiohttp |
< 3.12.14 Fix: upgrade to 3.12.14
|
| – | aiohttp | aiohttp |
< 3.12.14 cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* |
| Root:PyPI | – | rootio-aiohttp |
< 3.10.11+root.io.2 < 3.10.11+root.io.4 < 3.10.11+root.io.5 < 3.10.11+root.io.7 < 3.8.6+root.io.3 < 3.10.11+root.io.8 < 3.8.6+root.io.4 < 3.8.6+root.io.5 < 3.8.6+root.io.7 < 3.8.6+root.io.8 < 3.8.6+root.io.9 < 3.8.6+root.io.10 1 more version range
Fix: upgrade to 3.10.11+root.io.2
|
| Debian:11 | debian | python-aiohttp |
< 3.7.4-1+deb11u2 Fix: upgrade to 3.7.4-1+deb11u2
|
| Debian:12 | debian | python-aiohttp | All versions |
| Debian:13 | debian | python-aiohttp | All versions |
| Root:PyPI | aiohttp team | aiohttp |
< 3.10.11+aikido.4 < 3.10.11+aikido.5 < 3.10.11+aikido.7 < 3.8.6+aikido.11 < 3.12.13+aikido.3 < 3.8.6+aikido.12 Fix: upgrade to 3.10.11+aikido.4
|
| Ubuntu:Pro:16.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:25.10 | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | python-aiohttp | All versions |
| Debian:14 | debian | python-aiohttp |
< 3.12.15-1 Fix: upgrade to 3.12.15-1
|
| Root:PyPI | – | aiohttp |
< 3.10.11+aikido.11 < 3.9.1+aikido.9 Fix: upgrade to 3.10.11+aikido.11
|
Original advisory text
CVE-2025-53643 in aiohttp - Patched by Root
Root has patched CVE-2025-53643 in the aiohttp package for Root:PyPI. Multiple fixed versions available.
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj Vendor Advisory
- https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2... Patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-53643
- https://github.com/advisories/GHSA-9548-qrrj-x5pj
- https://github.com/aio-libs/aiohttp Product
- https://pypi.org/project/aiohttp Product
- https://www.cve.org/CVERecord?id=CVE-2025-53643 Third Party Advisory
- https://ubuntu.com/security/CVE-2025-53643 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-53643 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Mar 2026
Sources
DEBIAN-CVE-2025-53643 · OSV
GHSA-9548-qrrj-x5pj · GHSA
CVE-2025-53643 · NVD
PYSEC-2026-1104 · OSV
UBUNTU-CVE-2025-53643 · OSV
Track software like this
Free during beta