AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4613 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4613-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     June 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.7.4-1+deb11u2     CVE ID         : CVE-2025-53643 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226                      CVE-2025-69227 CVE-2025-69228 CVE-2025-69229 CVE-2026-22815                      CVE-2026-34513 CVE-2026-34514 CVE-2026-34516 CVE-2026-34517                      CVE-2026-34518 CVE-2026-34519 CVE-2026-34520 CVE-2026-34525


    Several vulnerabilities have been found in aiohttp, an asynchronous     HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections        of an HTTP request.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the        presence of non-ASCII characters.

    CVE-2025-69225

       Parser logic which allows non-ASCII decimals to be present in the        Range header.

    CVE-2025-69226

       Path traversal vulnerability that allows an attacker to ascertain        the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert        statements are bypassed leading to a possible DoS attack.

    CVE-2025-69228

       Possible DoS attack that can freeze the server by exhausting the        memory using Request.post().

    CVE-2025-69229

       The handling of chunked messages that can result in an excessive        blocking of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       Uncapped memory usage due to insufficient restrictions in header and        trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an        unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive        number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields        due to reading the entiry field into memory before checking        client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-        Authorization headers When following redirects to a different        origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control        characters accordingly to RFC 9110.

    CVE-2026-34525

       Headers can be duplicated, e.g. the host header.


    For Debian 11 bullseye, these problems have been fixed in version     3.7.4-1+deb11u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2760 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
    * python3.12-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP     redirects (streaming API) (CVE-2026-21441)
    * python3.12-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20204-1 advisory.

    Changes in python-aiohttp:

    - CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
    - CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
    - CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies     (bsc#1256018).
    - CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
    - CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
    - CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
    - CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
    - CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section     (bsc#1246517).

    Changes in python-Brotli:

    - Add max length decompression (bsc#1254867, bsc#1256017).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03201-1 advisory.

    - CVE-2025-53643: request smuggling vulnerability due to incorrect parsing trailer sections of an HTTP     request       (bsc#1246517).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03057-1 advisory.

    - CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section     (bsc#1246517)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14,     the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections     of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions)     or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to     bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
    (CVE-2025-53643)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of aioHTTP installed on the remote host is prior to 3.12.14. It is, therefore, affected by a request smuggling vulnerability:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python     parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If     a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is     enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy     protections. Version 3.12.14 contains a patch for this issue. (CVE-2025-53643)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14,
    the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections
    of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions)
    or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to
    bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
    (CVE-2025-53643)

ID	Name	Product	Family	Type	Severity
318080	Debian dla-4613 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	Local	high
299192	RHEL 9 : Satellite 6.18.3 Async Update (Important) (RHSA-2026:2760)	Nessus	Red Hat Local Security Checks	Local	high
299126	openSUSE 16 Security Update : python-aiohttp, python-Brotli (openSUSE-SU-2026:20204-1)	Nessus	SuSE Local Security Checks	Local	high
264668	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2025:03201-1)	Nessus	SuSE Local Security Checks	Local	medium
261230	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2025:03057-1)	Nessus	SuSE Local Security Checks	Local	medium
253116	Linux Distros Unpatched Vulnerability : CVE-2025-53643	Nessus	Misc.	Local	medium
242322	aioHTTP < 3.12.14 Request Smuggling (CVE-2025-53643)	Nessus	Misc.	Local	medium
428379	SCA: security update for aiohttp (GHSA-9548-qrrj-x5pj)	Tenable Cloud Security	SCA Checks	Local	medium
428379	SCA: security update for aiohttp (GHSA-9548-qrrj-x5pj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-53643

medium

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

medium