CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability
Summary
CVE-2025-53643: The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Affects aiohttp versions < 3.12.14. Fixed in 3.12.14. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2025-53643 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular Python library used for building asynchronous web applications. It provides an easy-to-use interface for handling HTTP requests and responses, making it a go-to choice for developers looking to create efficient web services. However, a vulnerability has been identified in its parsing mechanism, specifically related to chunked trailer sections of HTTP requests, which could lead to serious security issues.
Vulnerability Detail
The vulnerability arises from the Python parser's failure to correctly parse trailer sections of HTTP requests. This oversight allows attackers to exploit the library, potentially executing HTTP request smuggling attacks. Such attacks can enable malicious actors to bypass firewalls or proxy protections, leading to unauthorized access or data manipulation. The issue is particularly concerning for installations of AIOHTTP that do not utilize C extensions, as they are more susceptible to this flaw.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.12.14
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.12.14"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to ensure that AIOHTTP is installed with C extensions, as this may mitigate the risk associated with the vulnerability. However, this is not a permanent solution, and upgrading to the latest version is strongly recommended.
Conclusion
The CVE-2025-53643 vulnerability in AIOHTTP poses significant risks due to improper parsing of HTTP requests. Users are strongly advised to update to the patched version 3.12.14 to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2025-53643 is a vulnerability in the AIOHTTP library that allows for HTTP request smuggling due to improper parsing of chunked trailer sections.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The vulnerability can lead to unauthorized access, data manipulation, and the ability to bypass security measures such as firewalls and proxies.
Yes, a patch is available in version 3.12.14 of the AIOHTTP library. Users are encouraged to upgrade to this version.
If you cannot upgrade immediately, consider ensuring that AIOHTTP is installed with C extensions, as this may provide some level of protection against the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
