Alpine: multiple py3-aiohttp packages: security update to 3.13.3-r0

high Tenable Cloud Security Plugin ID 436691

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a
compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed
in version 3.13.3. (CVE-2025-69223)

- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.
If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or
AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to
bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3. (CVE-2025-69224)

- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known
impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.
This issue is fixed in version 3.13.3. (CVE-2025-69225)

- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below
enable an attacker to ascertain the existence of absolute path components through the path normalization
logic for static files meant to prevent path traversal. If an application uses web.static() (not
recommended for production deployments), it may be possible for an attacker to ascertain the existence of
path components. This issue is fixed in version 3.13.3. (CVE-2025-69226)

Plugin Details

Severity: High

ID: 436691

Version: Revision 1.9

Type: Local

Family: Alpine Linux Local Security Checks

Published: 1/12/2026

Updated: 7/6/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.15

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-69223

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2025-69224

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-69229

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/5/2026

Reference Information

CVE: CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229, CVE-2025-69230

Detections

Analytics