CoreCVE
Back

LOW

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Published Jul 14, 2025

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-444

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jul 14, 2025
Updated Jul 15, 2025
Reserved Jul 7, 2025
Link CVE-2025-53643
CISA Vulnrichment
Updated Jul 15, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2025-53643
Red Hat
Severity Low
Public date Jul 14, 2025
Links CVE-2025-53643 - Bugzilla
GHSA-9548-QRRJ-X5PJ