CVE-2025-53643: AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.
Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
----
Patch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.12.14 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.12.14Patch e8d774f635dc6d1cd3174d0e38891da5de0e2b6a - Compensating control
If a pure Python version of aiohttp is installed (i.e., without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, use compensating network controls (e.g., additional firewall/proxy protections) since an attacker may execute request smuggling to bypass certain firewalls or proxy protections until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53643?
CVE-2025-53643 is classified as a high severity vulnerability due to its potential for exploitation in request smuggling attacks.
How do I fix CVE-2025-53643?
To fix CVE-2025-53643, update aiohttp to version 3.12.14 or later.
What types of software are affected by CVE-2025-53643?
CVE-2025-53643 affects the pure Python version of aiohttp and scenarios where AIOHTTP_NO_EXTENSIONS is enabled.
What is the nature of the vulnerability in CVE-2025-53643?
CVE-2025-53643 is a request smuggling vulnerability caused by improper parsing of HTTP request trailer sections.
Are there any workarounds for CVE-2025-53643?
There are no known effective workarounds for CVE-2025-53643; updating to the patched version is recommended.