CVE-2025-53643 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

🗓️ 14 Jul 2025 20:17:18Reported by GitHub_MType

AIOHTTP is vulnerable to HTTP smuggling due to incorrect trailer parsing before version 3.12.14

Reporter	Title	Published	Views	Family All 79
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	17 Dec 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	18 Dec 202501:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software	14 Jan 202612:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses AIOHTTP asynchronous Python parser which is vulnerable to CVE-2025-53643.	23 Sep 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in AIOHTTP affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	29 Dec 202507:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Aug 2025	29 Aug 202510:45	–	ibm
Tenable Nessus	aioHTTP < 3.12.14 Request Smuggling (CVE-2025-53643)	18 Jul 202500:00	–	nessus

[
  {
    "vendor": "aio-libs",
    "product": "aiohttp",
    "versions": [
      {
        "version": "< 3.12.14",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
github	www.github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a

14 Jul 2025 20:17Current

CVSS 46.3

EPSS0.00424

CWE-444