CVE-2025-69228: AIOHTTP vulnerable to denial of service through large payloads
Summary A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.
Impact If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3Patch b7dbd35375aedbcd712cbae8ad513d56d11cce60
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69228?
CVE-2025-69228 has a critical severity rating due to its potential to exhaust server memory and cause denial of service.
How do I fix CVE-2025-69228?
To fix CVE-2025-69228, upgrade aiohttp to version 3.13.3 or later.
What type of systems are affected by CVE-2025-69228?
CVE-2025-69228 affects aiohttp servers that handle requests using the Request.post() method.
What is the impact of CVE-2025-69228?
The impact of CVE-2025-69228 is that an attacker can potentially freeze the server by exhausting its memory.
Is there a known exploit for CVE-2025-69228?
Yes, there are potential exploits that can craft requests to exploit CVE-2025-69228 and cause server denial of service.