6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69229

CVE-2025-69229: AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69229

CVE-2025-69229:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.13.2	3.13.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) in aiohttp's handling of chunked transfer encoding, as described in GHSA-g84x-mcqj-x9qq. The root cause is twofold. First, the server used a Python list to store the offsets of incoming chunks. When reading the body, it would call list.pop(0) to process the chunks sequentially. This operation has a time complexity of O(n), meaning its execution time grows linearly with the number of chunks. An attacker could send a request with a very large number of tiny chunks, causing this operation to consume excessive CPU time and block the server's event loop.

The second issue was the lack of any limit on the number of chunks that could be buffered. This allowed an attacker to create the conditions for the first issue by building up a very large list of chunk offsets in memory.

The patches address both problems:

Commit dc3170b56904bdf814228fae70a5501a42a6c712 replaces the list with a collections.deque, changing the inefficient pop(0) to an efficient popleft() operation with O(1) complexity. This directly mitigates the CPU exhaustion in the readchunk and _read_nowait_chunk methods.
Commit 4ed97a4e46eaf61bd0f05063245f613469700229 introduces a throttling mechanism based on the number of chunks. In end_http_chunk_receiving, it adds logic to pause reading from the socket if the number of buffered chunks exceeds a new _high_water_chunks limit, preventing the chunk buffer from growing indefinitely.

Therefore, the vulnerable functions are those that either performed the inefficient list operation or failed to prevent the chunk buffer from growing excessively. During exploitation, a profiler would show significant time spent in StreamReader.readchunk and StreamReader._read_nowait_chunk due to the pop(0) calls.

Vulnerable functions

StreamReader.readchunk

aiohttp/streams.py

The function used `list.pop(0)`, which has O(n) time complexity, on `_http_chunk_splits`. When processing a request with a large number of chunks, this linear-time operation caused excessive CPU usage, leading to a denial of service. The patch changes this to `deque.popleft()`, an O(1) operation.

StreamReader._read_nowait_chunk

aiohttp/streams.py

Similar to `readchunk`, this function used `list.pop(0)` in a loop to discard processed chunk markers. With a large number of chunks, this resulted in high CPU load due to the O(n) complexity of the pop operation, contributing to the DoS vulnerability. The fix was to replace it with the O(1) `deque.popleft()`.

StreamReader.end_http_chunk_receiving

aiohttp/streams.py

This function is responsible for processing the end of a chunk. Before the patch, it would append chunk metadata without any limit, allowing an attacker to send a massive number of chunks and build up an extremely large `_http_chunk_splits` list. The vulnerability lies in the absence of a throttling mechanism. The patch adds a check to pause reading if the number of chunks exceeds a high-water mark, preventing the list from growing uncontrollably.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.