CVE Tools
Sign in

CVE-2025-53643

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Published: Jul 14, 2025Updated: Aug 14, 2025 Sources: CVE List NVD GHSA BDUCWE-444
7.5HIGH
NVD MITRE
EPSS Score
0.3%
Top 78.7%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
OpenVAS

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:NI:HA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:NConfidentiality
None
I:HIntegrity
High
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-444

Affected Products

Novell Inc.
commercial·US
SUSE Linux Enterprise High Performance ComputingOn-prem
Operating Systems / linux-distro
SUSE Linux Enterprise Server for SAP ApplicationsOn-premOS
Operating Systems / linux-distro
SUSE Manager ProxyOn-prem
Operating Systems / linux-distro
SUSE Manager ServerOn-prem
Operating Systems / linux-distro
SUSE Manager Retail Branch ServerOn-prem
Operating Systems / linux-distro
SUSE Linux Enterprise Module for Public CloudOn-prem
Operating Systems / linux-distro
SUSE Enterprise StorageOn-prem
Operating Systems / linux-distro
Suse Linux Enterprise DesktopOn-premOS
Operating Systems / linux-distro
Red Hat Inc.
commercial·USaka red hat
Red Hat OpenShift LightspeedOn-prem
Operating Systems / linux-distro
OpenShift AIOn-prem
Operating Systems / linux-distro
aiohttp
oss-project
aiohttpLibrary
OSS Libraries / web-framework
PyPI
package-ecosystem
aiohttp
OSS Libraries
aio-libs
oss-projectaka aiohttp, aiosmtpd, aiohttp session
aiohttpLibrary
OSS Libraries / web-framework
ООО «Ред Софт»
commercial·RUaka red soft
РЕД ОСOn-premOS
Operating Systems / linux-distro
and 4 more affected products View all →

Exploitability

Official Patch Available
Is your org exposed to CVE-2025-53643?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique
Collection
View detailed technique mapping

References

https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
github.com
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
github.com
https://nvd.nist.gov/vuln/detail/CVE-2025-53643
nvd.nist.gov
and 6 more references View all →
News mentions
Could not load news mentions.

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-53643 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows