6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69228

CVE-2025-69228: AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69228

CVE-2025-69228:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.13.2	3.13.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a denial of service in aiohttp due to uncontrolled memory allocation when processing large payloads. The provided patch clearly indicates that the post method in aiohttp/web_request.py was modified to address this issue. The change involves how the size of incoming multipart data is calculated. Previously, the size was reset for each part of the multipart form, allowing an attacker to bypass the intended client_max_size limit by splitting a large payload into many smaller parts. The fix ensures the total size of all parts is checked against the limit. Therefore, the Request.post function is the vulnerable function, as it's responsible for processing the malicious input that triggers the memory exhaustion.

Vulnerable functions

Request.post

aiohttp/web_request.py

The vulnerability lies in the `post` method of the `Request` class. Before the patch, the `size` variable was reset to 0 for each part of a multipart request. This allowed an attacker to send a crafted request with many small parts, bypassing the `_client_max_size` limit and causing the server's memory to be exhausted. The patch fixes this by moving the initialization of `size = 0` outside the loop, so the size is accumulated across all parts of the multipart request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.