--- id: CVE-2025-69227 title: >- aiohttp: aiohttp: Denial of Service via specially crafted POST request (CVE-2025-69227) summary: >- A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provide… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-835 vendor: Red Hat product: Red Hat Ansible Automation Platform 2 affected: - openshift_lightspeed - openshift_service_mesh 2 - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - ai_inference_server 3.2 - ansible_automation_platform 2.18 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - migration_toolkit 1.8 - openshift_ai 2.25 patched: - ai_inference_server 3.2 - ansible_automation_platform 2.18 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - migration_toolkit 1.8 - openshift_ai 2.25 published: '2026-01-05' updated: '2026-09-14' sourceUpdated: '2026-09-14T17:35:39+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69227.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69227.json - url: 'https://access.redhat.com/security/cve/CVE-2025-69227' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427256' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-69227' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69227' - url: >- https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259 - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23 - url: 'https://access.redhat.com/errata/RHSA-2026:6761' - url: 'https://access.redhat.com/errata/RHSA-2026:5809' - url: 'https://access.redhat.com/errata/RHSA-2026:6762' - url: 'https://access.redhat.com/errata/RHSA-2026:55853' - url: 'https://access.redhat.com/errata/RHSA-2026:55852' - url: 'https://access.redhat.com/errata/RHSA-2026:13553' - url: 'https://access.redhat.com/errata/RHSA-2026:13545' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:41928' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:3782' - url: 'https://github.com/aio-libs/aiohttp' tags: - csaf - vex - red-hat - osv - pip epss: 0.00387 epssPercentile: 0.29959 aliases: - GHSA-jj3x-wxrx-4x23 - PYSEC-2026-1107 ecosystem: pip ingestedAt: '2026-07-08T18:25:50.811Z' --- ## Overview A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provided that Python optimizations are enabled. This could lead to an infinite loop, resulting in a Denial of Service (DoS) attack, making the affected application unavailable. ## Vendor advisories - **RHSA-2026:6761** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6761) - **RHSA-2026:5809** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5809) - **RHSA-2026:6762** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6762) - **RHSA-2026:55853** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55853) - **RHSA-2026:55852** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55852) - **RHSA-2026:13553** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13553) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928) - **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69227.json) **aiohttp: aiohttp: Denial of Service via specially crafted POST request** — rated Moderate by Red Hat. Released 2025-01-01, updated 2026-09-14. Affected: - OpenShift Lightspeed - OpenShift Service Mesh 2 - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat AI Inference Server 3.2 - Red Hat Ansible Automation Platform 2.18 - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift AI 2.25 No fix planned: - Red Hat Ansible Automation Platform 2 - OpenShift Lightspeed - OpenShift Service Mesh 2 - Red Hat AI Inference Server - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Not affected: - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift AI 2.25 - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift AI (RHOAI) ## Remediation For more information visit https://access.redhat.com/errata/RHSA-2026:6761 https://access.redhat.com/errata/RHSA-2026:6761 For more information visit https://access.redhat.com/errata/RHSA-2026:5809 https://access.redhat.com/errata/RHSA-2026:5809 For more information visit https://access.redhat.com/errata/RHSA-2026:6762 https://access.redhat.com/errata/RHSA-2026:6762 Workarounds / mitigations: - No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. ## Package advisory (CVE-2025-69227) Affected packages: - `aiohttp < 3.13.3` Patched in: - `aiohttp 3.13.3` Source: https://osv.dev/vulnerability/GHSA-jj3x-wxrx-4x23