CVE-2025-53643: AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

July 14, 2025 (updated November 10, 2025)

The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

References

github.com/advisories/GHSA-9548-qrrj-x5pj
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
nvd.nist.gov/vuln/detail/CVE-2025-53643

Code Behaviors & Features

Detect and mitigate CVE-2025-53643 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →