CVE-2025-69227: AIOHTTP Denial of Service Vulnerability Due to Assert Bypass
Summary
CVE-2025-69227: AIOHTTP vulnerable to DoS when bypassing asserts. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Also tracked for
The same CVE-2025-69227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle web requests and responses efficiently. It provides features such as web server capabilities, client-side HTTP requests, and support for WebSockets. However, it is susceptible to a denial of service (DoS) vulnerability when assert statements are bypassed, particularly when processing POST requests.
Vulnerability Detail
The vulnerability arises when optimizations are enabled in Python, such as using the '-O' flag or setting 'PYTHONOPTIMIZE=1'. In this scenario, assert statements in the AIOHTTP framework can be bypassed, leading to the potential for an infinite loop during the processing of POST bodies. This can allow an attacker to craft a malicious message that causes the application to hang, resulting in a denial of service. The affected versions are those prior to 3.13.3, with the last known affected version being 3.13.2.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid running your application with optimizations enabled. This can be done by ensuring that you do not use the '-O' flag or set 'PYTHONOPTIMIZE=1' when starting your Python application.
Conclusion
The AIOHTTP framework has a vulnerability that can lead to denial of service attacks when assert statements are bypassed under certain conditions. It is crucial to update to the latest version to protect your application from potential exploitation.
See every vulnerability recorded for aiohttp →
FAQ
The vulnerability allows for a denial of service attack due to the bypassing of assert statements when optimizations are enabled.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring sign-up.
AIOHTTP versions prior to 3.13.3 are affected, with the last known vulnerable version being 3.13.2.
Update your AIOHTTP package to version 3.13.3 or later to mitigate the vulnerability.
The CVSS score for this vulnerability is 6.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
