Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2025-69229: aiohttp may let attackers slow server with many chunks
CVE-2025-69229 · published 10 months ago
Summary
The aiohttp library used for Python web services can consume a lot of CPU when it receives a very large number of small data pieces (chunks). An attacker who sends many chunks can make the server pause for a noticeable time, reducing its ability to handle other users. Upgrade to version 3.13.3 or later to stop this behavior.
What to do
- Update aiohttp team aiohttp to version 3.13.3.
- Update debian python-aiohttp to version 3.11.16-1+deb13u1.
- Update debian python-aiohttp to version 3.13.3-1.
- Update aiohttp team aiohttp to version 3.10.11+aikido.4.
- Update rootio-aiohttp to version 3.10.11+root.io.4.
- Update aiohttp team aiohttp to version 3.10.11+aikido.5.
- Update rootio-aiohttp to version 3.10.11+root.io.5.
- Update rootio-aiohttp to version 3.10.11+root.io.7.
- Update rootio-aiohttp to version 3.12.14+root.io.3.
- Update rootio-aiohttp to version 3.12.15+root.io.6.
- Update rootio-aiohttp to version 3.12.14+root.io.4.
- Update rootio-aiohttp to version 3.12.14+root.io.5.
- Update rootio-aiohttp to version 3.8.6+root.io.7.
- Update rootio-aiohttp to version 3.8.6+root.io.9.
- Update canonical python-aiohttp to version 3.0.1-1ubuntu0.1~esm6.
- Update canonical python-aiohttp to version 3.8.1-4ubuntu0.2+esm2.
- Update canonical python-aiohttp to version 3.9.1-1ubuntu0.1+esm2.
- Update canonical python-aiohttp to version 3.11.16-1ubuntu0.1.
- Update rootio-aiohttp to version 3.8.6+root.io.10.
- Update aiohttp team aiohttp to version 3.12.14+aikido.7.
- Update aiohttp team aiohttp to version 3.12.15+aikido.8.
- Update aiohttp team aiohttp to version 3.10.11+aikido.7.
- Update aiohttp team aiohttp to version 3.8.6+aikido.11.
- Update aiohttp team aiohttp to version 3.8.6+aikido.12.
- Update aiohttp to version 3.9.1+aikido.9.
- Update aiohttp to version 3.12.14+aikido.9.
- Update debian python-aiohttp to version 3.8.4-1+deb12u2.
- Update aiohttp aiohttp to version 3.13.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | aiohttp | aiohttp |
< 3.13.3 cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* |
| pip | aiohttp team | aiohttp |
<= 3.13.2 Fix: upgrade to 3.13.3
|
| Debian:11 | debian | python-aiohttp | All versions |
| Debian:12 | debian | python-aiohttp |
< 3.8.4-1+deb12u2 Fix: upgrade to 3.8.4-1+deb12u2
|
| Debian:13 | debian | python-aiohttp |
< 3.11.16-1+deb13u1 Fix: upgrade to 3.11.16-1+deb13u1
|
| Debian:14 | debian | python-aiohttp |
< 3.13.3-1 Fix: upgrade to 3.13.3-1
|
| Root:PyPI | aiohttp team | aiohttp |
< 3.10.11+aikido.4 < 3.10.11+aikido.5 < 3.12.14+aikido.7 < 3.12.15+aikido.8 < 3.10.11+aikido.7 < 3.8.6+aikido.11 < 3.8.6+aikido.12 Fix: upgrade to 3.10.11+aikido.4
|
| Root:PyPI | – | rootio-aiohttp |
< 3.10.11+root.io.4 < 3.10.11+root.io.5 < 3.10.11+root.io.7 < 3.12.14+root.io.3 < 3.12.15+root.io.6 < 3.12.14+root.io.4 < 3.12.14+root.io.5 < 3.8.6+root.io.7 < 3.8.6+root.io.9 < 3.8.6+root.io.10 Fix: upgrade to 3.10.11+root.io.4
|
| PyPI | aiohttp team | aiohttp |
< 3.13.3 Fix: upgrade to 3.13.3
|
| Ubuntu:Pro:16.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python-aiohttp |
< 3.0.1-1ubuntu0.1~esm6 Fix: upgrade to 3.0.1-1ubuntu0.1~esm6
|
| Ubuntu:Pro:22.04:LTS | canonical | python-aiohttp |
< 3.8.1-4ubuntu0.2+esm2 Fix: upgrade to 3.8.1-4ubuntu0.2+esm2
|
| Ubuntu:Pro:24.04:LTS | canonical | python-aiohttp |
< 3.9.1-1ubuntu0.1+esm2 Fix: upgrade to 3.9.1-1ubuntu0.1+esm2
|
| Ubuntu:25.10 | canonical | python-aiohttp |
< 3.11.16-1ubuntu0.1 Fix: upgrade to 3.11.16-1ubuntu0.1
|
| Root:PyPI | – | aiohttp |
< 3.9.1+aikido.9 < 3.12.14+aikido.9 Fix: upgrade to 3.9.1+aikido.9
|
Original advisory text
AIOHTTP vulnerable to DoS through chunked messages
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69229... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-69229 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-69229 Vendor Advisory
- https://github.com/advisories/GHSA-g84x-mcqj-x9qq
- https://github.com/aio-libs/aiohttp Product
- https://pypi.org/project/aiohttp Product
- https://ubuntu.com/security/CVE-2025-69229 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-69229 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8032-1 Vendor Advisory
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq Vendor Advisory
- https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700... Patch
- https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published6 Jan 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
DEBIAN-CVE-2025-69229 · OSV
CVE-2025-69229 · NVD
GHSA-g84x-mcqj-x9qq · GHSA
CVE-2025-69229 · OSV
PYSEC-2026-1106 · OSV
UBUNTU-CVE-2025-69229 · OSV
Track software like this
Free during beta