CVE-2025-69227
Denial of Service via POST Body in AIOHTTP
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aio-libs | aiohttp | to 3.13.2 (inc) |
| aio-libs | aiohttp | 3.13.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69227 is a denial-of-service (DoS) vulnerability in the aiohttp Python package versions 3.13.2 and below. When Python optimizations are enabled (using the -O flag or PYTHONOPTIMIZE=1), assert statements are bypassed. If an application uses a handler that calls the Request.post() method to process POST request bodies, an attacker can send a specially crafted POST message that triggers an infinite loop during processing. This infinite loop causes the application to become unresponsive, resulting in a DoS condition. The issue was fixed in version 3.13.3 by replacing assert statements with explicit exception handling to properly detect and handle malformed multipart data. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause your aiohttp-based application to become unresponsive due to an infinite loop triggered by a maliciously crafted POST request when Python optimizations are enabled. This results in a denial-of-service (DoS) attack, potentially disrupting service availability and impacting users who rely on the application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for application unresponsiveness or infinite loops when processing POST requests in aiohttp applications running with Python optimizations enabled (-O or PYTHONOPTIMIZE=1). Since the vulnerability triggers an infinite loop on specially crafted POST bodies processed by handlers using Request.post(), you can detect it by sending crafted POST requests to test endpoints and observing if the application hangs or consumes excessive CPU. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to upgrade aiohttp to version 3.13.3 or later, where the vulnerability is fixed by replacing assert statements with explicit exception handling to prevent infinite loops. Additionally, avoid running Python with optimizations enabled (-O or PYTHONOPTIMIZE=1) until the upgrade is applied, as the vulnerability only manifests under these conditions. [1, 2]