CVE-2025-69229
Denial of Service via CPU Blocking in AIOHTTP Chunked Handling
Publication date: 2026-01-06
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aio-libs | aiohttp | to 3.13.2 (inc) |
| aio-libs | aiohttp | 3.13.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69229 is a denial-of-service (DoS) vulnerability in the aiohttp Python library affecting versions 3.13.2 and below. It occurs due to inefficient handling of HTTP chunked messages when a large number of chunks are received. Specifically, when an application uses the request.read() method, an attacker can send a request with many small chunks that cause the server to spend excessive blocking CPU time (around 1 second) processing the request. This blocks the server from handling other requests, potentially leading to a DoS. The vulnerability was fixed by improving the internal data structures and adding chunk count-based flow control to efficiently manage chunked data and prevent event loop blocking. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by causing your aiohttp-based server to become unresponsive or slow when processing specially crafted HTTP requests with many small chunks. An attacker can exploit this to cause your server to spend excessive CPU time blocking on reading the request body, preventing it from handling other incoming requests. This can lead to a denial-of-service condition, reducing the availability and reliability of your service. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for excessive CPU usage on servers running aiohttp versions 3.13.2 or below when processing HTTP requests with chunked transfer encoding. Specifically, look for requests that use the request.read() method and cause blocking CPU time around 1 second. Network traffic analysis tools can be used to identify HTTP requests with a large number of small chunks. While no specific commands are provided in the resources, general approaches include using system monitoring tools like 'top' or 'htop' to detect CPU spikes, and network packet capture tools like 'tcpdump' or 'Wireshark' to analyze chunked HTTP requests. Additionally, reviewing aiohttp server logs for unusually slow request processing times may help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the aiohttp library to version 3.13.3 or later, where the vulnerability is fixed. The fix includes changes to internal data structures and flow control mechanisms that prevent excessive CPU blocking by limiting the number of HTTP chunks processed before pausing reading. If upgrading is not immediately possible, consider implementing rate limiting or request size limits on your server to reduce the impact of malicious chunked requests. Monitoring and alerting on high CPU usage related to HTTP request processing can also help mitigate potential denial-of-service conditions. [1, 2, 3]