Aiohttp Patches Seven Vulnerabilities Including High-Severity DoS Risks

Maintainers of aiohttp have released version 3.13.3 to patch seven vulnerabilities, spanning high-severity Denial of Service risks to information leaks and request handling flaws. The two high-severity issues could cripple servers: CVE-2025-69228 allows an attacker to craft a request that fills the server’s memory, potentially freezing the server if a handler uses Request[.]post(), while CVE-2025-69227 involves a logic flaw where bypassed asserts can trigger an infinite loop via specially crafted POST messages.

Other fixes include CVE-2025-69229, a Chunked Message DoS that can cause excessive CPU usage; and CVE-2025-69230, a Cookie Warning Storm that may generate a flood of log entries. The update also covers data parsing and information disclosure weaknesses: CVE-2025-69224 and CVE-2025-69225, related to non-ASCII characters in requests, and CVE-2025-69226, a Static Path Leak affecting the use of web[.]static(). All vulnerabilities affect aiohttp versions 3.13.2 and earlier, with a clear directive to upgrade to 3.13.3 immediately.