Detections
Analytics

SCA: security update for aiohttp (GHSA-g84x-mcqj-x9qq)

high Tenable Cloud Security Plugin ID 436572

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and
 below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large
 number of chunks. If an application makes use of the request.read() method in an endpoint, it may be
 possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1
 second) while processing the request. This could potentially lead to DoS as the server would be unable to
 handle other requests during that time. This issue is fixed in version 3.13.3. (CVE-2025-69229)

See Also

https://github.com/advisories/GHSA-g84x-mcqj-x9qq

Plugin Details

Severity: High

ID: 436572

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 1/6/2026

Updated: 7/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.15

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2025-69229

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/5/2026

Vulnerability Publication Date: 1/5/2026

Reference Information

CVE: CVE-2025-69229

IAVB: 2026-B-0001

cwe: CWE-770