AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0859-1 advisory.

    - CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
    - CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
    - CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies     (bsc#1256018).
    - CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
    - CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
    - CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
    - CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0858-1 advisory.

    - CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
    - CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
    - CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies     (bsc#1256018).
    - CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
    - CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
    - CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
    - CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8032-1 advisory.

    Charles Chan discovered that AIOHTTP incorrectly handled the decompression of compressed requests. A     remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed     in Ubuntu 25.10. (CVE-2025-69223)

    Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII characters in HTTP headers. A remote     attacker could possibly use this issue to perform a request smuggling attack to bypass certain proxy     protections. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10.
    (CVE-2025-69224)

    Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII characters in the Range header. A     remote attacker could possibly use this issue to perform a request smuggling attack. (CVE-2025-69225)

    Thomas Rinsma discovered that AIOHTTP incorrectly handled path normalization when serving static files. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2025-69226)

    Thomas Rinsma discovered that AIOHTTP incorrectly handled certain POST request bodies. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2025-69227)

    Thomas Rinsma discovered that AIOHTTP incorrectly handled large POST request payloads. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2025-69228)

    It was discovered that AIOHTTP incorrectly handled chunked messages. A remote attacker could possibly use     this issue to cause a denial of service. (CVE-2025-69229)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20204-1 advisory.

    Changes in python-aiohttp:

    - CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
    - CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
    - CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies     (bsc#1256018).
    - CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
    - CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
    - CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
    - CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
    - CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section     (bsc#1246517).

    Changes in python-Brotli:

    - Add max length decompression (bsc#1254867, bsc#1256017).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and     below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large     number of chunks. If an application makes use of the request.read() method in an endpoint, it may be     possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1     second) while processing the request. This could potentially lead to DoS as the server would be unable to     handle other requests during that time. This issue is fixed in version 3.13.3. (CVE-2025-69229)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
302110	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:0859-1)	Nessus	SuSE Local Security Checks	high
301812	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2026:0858-1)	Nessus	SuSE Local Security Checks	high
299345	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : AIOHTTP vulnerabilities (USN-8032-1)	Nessus	Ubuntu Local Security Checks	high
299126	openSUSE 16 Security Update : python-aiohttp, python-Brotli (openSUSE-SU-2026:20204-1)	Nessus	SuSE Local Security Checks	high
281876	Linux Distros Unpatched Vulnerability : CVE-2025-69229	Nessus	Misc.	high

Detections

Analytics

CVE-2025-69229

high

Tenable Plugins

high

high

high

high

high