Read the docs
TI-2025-33569 Aliases CVE-2025-53643GHSA-9548-qrrj-x5pj

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Priority LOW 10CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 9 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Partial aiohttp (aio-libs): 3.12.14aiohttp (PyPI): 3.12.14Red Hat: 8 advisoriesRed Hat: 9 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aio-libsaiohttpbefore 3.12.143.12.14Patch availableCNA
—aiohttp (PyPI)before 3.12.143.12.14Patch availableGHSA-9548-qrrj-x5pj
  • aiohttp Vendoraio-libs Affected before 3.12.14 Fixed in 3.12.14 Patch available CNA
  • aiohttp (PyPI) Vendor— Affected before 3.12.14 Fixed in 3.12.14 Patch available GHSA-9548-qrrj-x5pj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*before 3.12.14VulnerableAiohttp
  • cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions before 3.12.14 Vulnerable ·Aiohttp

Remediation

  • Fix · CNA aiohttp (aio-libs) Fixed in 3.12.14
  • Fix · GHSA-9548-qrrj-x5pj aiohttp (PyPI) Fixed in 3.12.14 Advisory →

Red Hat 8 advisories

  • RHSA-2026:3960 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
  • RHSA-2026:2760 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.18.3 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp-3.13.3-1.el9pc, python3.12-urllib3-2.6.3-1.el9pc
  • RHSA-2026:1506 Released 2026-01-28 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.25-1.el8ap, python3.11-django-4.2.27-1.el8ap, python3.11-urllib3-2.6.3-1.el8ap +1
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.25-1.el9ap, python3.11-django-4.2.27-1.el9ap, python3.11-urllib3-2.6.3-1.el9ap +1
Show 5 more Red Hat advisories
  • RHSA-2026:1249 Released 2026-01-26 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.3-2.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower-4.7.8-1.el9ap, python3.11-django-4.2.27-2.el9ap, python3.11-protobuf-4.25.8-1.el9ap +2
  • RHSA-2025:23531 Released 2025-12-17 · Red Hat rating Important
    RHOAI 2.25.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
  • RHSA-2025:22944 Released 2025-12-09 · Red Hat rating Low
    Red Hat OpenShift Service Mesh 3.1.4
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9
  • RHSA-2025:22939 Released 2025-12-09 · Red Hat rating Low
    Red Hat OpenShift Service Mesh 3.0.7
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9
  • RHSA-2025:22759 Released 2025-12-04 · Red Hat rating Important
    RHOAI 2.22.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:1506
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:1506
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:3960
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:1249
Red Hat OpenShift AI 2.22Fixed RHSA-2025:22759
Red Hat OpenShift AI 2.25Fixed RHSA-2025:23531
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2025:22939
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2025:22944
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:2760
Not affected: 19 products
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Red Hat AI Inference Server
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Enterprise Linux AI (RHEL AI)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.22
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift distributed tracing 3
  • Red Hat Satellite 6
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53643
  2. 2026-10-03 Alias added: GHSA-9548-qrrj-x5pj

References

Patch 1

Advisory 2

Other 1

  • TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
  • TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
  • TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
  • TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
  • TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
  • TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences