AIOHTTP vulnerable to DoS through chunked messages
Summary
Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.
Impact
If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.
Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712 Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | aiohttp | < 3.13.3 | 3.13.3 |
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq
- https://nvd.nist.gov/vuln/detail/CVE-2025-69229
- https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
- https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
- https://github.com/aio-libs/aiohttp
- https://pypi.org/project/aiohttp
- https://github.com/advisories/GHSA-g84x-mcqj-x9qq
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-770- Platform
- Python (PyPI)
- Package
aiohttp- Disclosed
- 05.01.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1106 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-g84x-mcqj-x9qq - CC BY 4.0
Vulnerability history: aiohttp
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 55
- First → latest
- 02.2021 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 29
- Low 19
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 6
- 2024: 7
- 2025: 1
- 2026: 40
-
AIOHTTP vulnerable to DoS through chunked messages this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.