{"id":"CVE-2025-53643","published":"2025-07-14T20:17:18Z","modified":"2025-07-15T19:50:40Z","title":"AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","vendor":"aio-libs","product":"aiohttp","tier":"tail","description":{"text":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":1.7,"severity":"LOW","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00355,"percentile":0.2926,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a","tags":["x_refsource_MISC"]}],"priority":{"score":7.0,"factors":[{"name":"EPSS percentile","points":5.85},{"name":"CVSS severity","points":1.19}]},"vendorSlug":"aio-libs","affectedVersions":[{"vendor":"aio-libs","product":"aiohttp","versions":["< 3.12.14"]}],"affected":[{"ecosystem":"PyPI","package":"aiohttp","vulnerableRanges":["<3.12.14"],"patched":["3.12.14"],"from":["GHSA-9548-qrrj-x5pj","PYSEC-2026-1104"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-21384","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-42367","published":"2024-08-09","fixed":"3.10.2","kev":false},{"cve":"CVE-2024-52303","published":"2024-11-18","fixed":"3.10.11","kev":false,"link":{"from":"CVE-2024-52303","to":"CVE-2025-53643","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:aiohttp","fromFixed":"3.10.11","toFixed":"3.12.14","daysApart":238}]}},{"cve":"CVE-2024-52304","published":"2024-11-18","fixed":"3.10.11","kev":false},{"cve":"CVE-2025-53643","published":"2025-07-14","fixed":"3.12.14","kev":false},{"cve":"CVE-2025-69223","published":"2026-01-05","fixed":"3.13.3","kev":false},{"cve":"CVE-2025-69224","published":"2026-01-05","fixed":"3.13.3","kev":false},{"cve":"CVE-2025-69225","published":"2026-01-05","fixed":"3.13.3","kev":false}],"package":"PyPI:aiohttp"}}