--- id: CVE-2025-69228 title: >- aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228) summary: >- A flaw was found in aiohttp. A remote attacker can craft a malicious request that, when processed by an aiohttp server using the `Request.post()` method, causes the server's memory to fill uncontrollably. This can lead to a Denial of Servi… severity: medium cvss: 6.8 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-770 vendor: Red Hat product: Red Hat OpenShift AI (RHOAI) affected: - openshift_lightspeed - openshift_service_mesh 2 - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - ai_inference_server 3.2 - ansible_automation_platform 2.18 - ansible_automation_platform 2.6 - migration_toolkit 1.8 - openshift_ai 2.25 patched: - ai_inference_server 3.2 - ansible_automation_platform 2.18 - ansible_automation_platform 2.6 - migration_toolkit 1.8 - openshift_ai 2.25 published: '2026-01-05' updated: '2026-09-14' sourceUpdated: '2026-09-14T17:35:17+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69228.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69228.json - url: 'https://access.redhat.com/security/cve/CVE-2025-69228' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427254' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-69228' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69228' - url: >- https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60 - url: >- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf - url: 'https://access.redhat.com/errata/RHSA-2026:6761' - url: 'https://access.redhat.com/errata/RHSA-2026:5809' - url: 'https://access.redhat.com/errata/RHSA-2026:6762' - url: 'https://access.redhat.com/errata/RHSA-2026:55853' - url: 'https://access.redhat.com/errata/RHSA-2026:55852' - url: 'https://access.redhat.com/errata/RHSA-2026:13545' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:41928' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:3782' - url: 'https://github.com/aio-libs/aiohttp' tags: - csaf - vex - red-hat - osv - pip epss: 0.00398 epssPercentile: 0.33865 aliases: - GHSA-6jhg-hg63-jvvf - PYSEC-2026-1100 ecosystem: pip ingestedAt: '2026-07-08T18:25:46.486Z' --- ## Overview A flaw was found in aiohttp. A remote attacker can craft a malicious request that, when processed by an aiohttp server using the `Request.post()` method, causes the server's memory to fill uncontrollably. This can lead to a Denial of Service (DoS) by freezing the server, making it unavailable to legitimate users. ## Vendor advisories - **RHSA-2026:6761** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6761) - **RHSA-2026:5809** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5809) - **RHSA-2026:6762** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6762) - **RHSA-2026:55853** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55853) - **RHSA-2026:55852** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.18 · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55852) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928) - **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, OpenShift Service Mesh 2, Red Hat AI Inference Server, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69228.json) **aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request** — rated Moderate by Red Hat. Released 2025-01-01, updated 2026-09-14. Affected: - OpenShift Lightspeed - OpenShift Service Mesh 2 - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat AI Inference Server 3.2 - Red Hat Ansible Automation Platform 2.18 - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift AI 2.25 No fix planned: - Red Hat Ansible Automation Platform 2 - OpenShift Lightspeed - OpenShift Service Mesh 2 - Red Hat AI Inference Server - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Not affected: - Red Hat Ansible Automation Platform 2.6 - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift AI 2.25 - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift AI (RHOAI) ## Remediation For more information visit https://access.redhat.com/errata/RHSA-2026:6761 https://access.redhat.com/errata/RHSA-2026:6761 For more information visit https://access.redhat.com/errata/RHSA-2026:5809 https://access.redhat.com/errata/RHSA-2026:5809 For more information visit https://access.redhat.com/errata/RHSA-2026:6762 https://access.redhat.com/errata/RHSA-2026:6762 Workarounds / mitigations: - No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. ## Package advisory (CVE-2025-69228) Affected packages: - `aiohttp < 3.13.3` Patched in: - `aiohttp 3.13.3` Source: https://osv.dev/vulnerability/GHSA-6jhg-hg63-jvvf