AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
    allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a
    compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed
    in version 3.13.3. (CVE-2025-69223)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
    of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.
    If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or
    AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to
    bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3. (CVE-2025-69224)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
    contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known
    impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.
    This issue is fixed in version 3.13.3. (CVE-2025-69225)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
    enable an attacker to ascertain the existence of absolute path components through the path normalization
    logic for static files meant to prevent path traversal. If an application uses web.static() (not
    recommended for production deployments), it may be possible for an attacker to ascertain the existence of
    path components. This issue is fixed in version 3.13.3. (CVE-2025-69226)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and
    below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed
    in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially
    crafted Cookie header. This issue is fixed in 3.13.3. (CVE-2025-69230)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and     below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed     in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially     crafted Cookie header. This issue is fixed in 3.13.3. (CVE-2025-69230)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
436691	Alpine: multiple py3-aiohttp packages: security update to 3.13.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
436691	Alpine: multiple py3-aiohttp packages: security update to 3.13.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
436571	SCA: security update for aiohttp (GHSA-fh55-r93g-j68g)	Tenable Cloud Security	SCA Checks	medium
436571	SCA: security update for aiohttp (GHSA-fh55-r93g-j68g)	Tenable Self-Hosted Container Security	SCA Checks	medium
281878	Linux Distros Unpatched Vulnerability : CVE-2025-69230	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-69230

medium

Tenable Plugins

high

high

medium

medium

medium