https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T08:07:10.864241+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-69227 CVE-2025-69227 — AIOHTTP vulnerable to DoS when bypassing asserts 2026-10-15T08:07:10.866003+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

 https://cve.radiocsirt.org/vuln/usn-8032-1 USN-8032-1 — python-aiohttp vulnerabilities 2026-10-15T08:07:10.866054+00:00

Affected: Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp

Charles Chan discovered that AIOHTTP incorrectly handled the decompression of compressed requests. A remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 25.10. (CVE-2025-69223)

Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII characters in HTTP headers. A remote attacker could possibly use this issue to perform a request smuggling attack to bypass certain proxy protections. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-69224)

Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII characters in the Range header. A remote attacker could possibly use this issue to perform a request smuggling attack. (CVE-2025-69225)

Thomas Rinsma discovered that AIOHTTP incorrectly handled path normalization when serving static files. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2025-69226)

Thomas Rinsma discovered that AIOHTTP incorrectly handled certain POST request bodies. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2025-69227)

Thomas Rinsma discovered that AIOHTTP incorrectly handled large POST request payloads. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2025-69228)

It was discovered that AIOHTTP incorrectly handled chunked messages. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2025-692…