Bug 2427256 (CVE-2025-69227)

Summary: CVE-2025-69227 aiohttp: aiohttp: Denial of Service via specially crafted POST request
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, alinfoot, anpicker, anthomas, bbrownin, bdettelb, bparees, carogers, caswilli, dfreiber, doconnor, drow, dtrifiro, dymurray, ehelms, erezende, ggainey, haoli, hasun, hkataria, ibolton, jajackso, jburrell, jcammara, jdobes, jfula, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jowilson, jsamir, juwatts, jwong, kaycoth, kegrant, koliveir, kshier, lphiri, mabashia, mhulan, nmoumoul, nyancey, omaciel, ometelka, orabin, osousa, pakotvan, pbohmill, pbraun, pcreech, pgaikwad, ptisnovs, rbryant, rchan, rjohnson, shvarugh, simaishi, slucidi, smallamp, smcdonal, sseago, stcannon, sthirugn, syedriko, teagle, tfister, thavo, tmalecek, ttakamiy, vkumar, weaton, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provided that Python optimizations are enabled. This could lead to an infinite loop, resulting in a Denial of Service (DoS) attack, making the affected application unavailable.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-06 00:01:42 UTC 
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.