{"id":"CVE-2025-53643","aliases":["GHSA-9548-qrrj-x5pj","PYSEC-2026-1104"],"title":" AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","summary":" AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","severity":"low","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.12.14"],"patched":["aiohttp 3.12.14"],"published":"2025-07-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:26.231846188Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9548-qrrj-x5pj","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["osv","pip"],"epss":0.00312,"epssPercentile":0.24163,"ingestedAt":"2026-07-08T18:25:47.749Z","slug":"CVE-2025-53643","body":"## Overview\n\n### Summary\nThe Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a\n\n## Affected packages\n\n- `aiohttp < 3.12.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.12.14`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}