CVE-2025-69228: AIOHTTP vulnerable to denial of service through large payloads

January 5, 2026 (updated January 6, 2026)

A request can be crafted in such a way that an aiohttp server’s memory fills up uncontrollably during processing.

References

github.com/advisories/GHSA-6jhg-hg63-jvvf
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60
github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf
nvd.nist.gov/vuln/detail/CVE-2025-69228

Code Behaviors & Features

Detect and mitigate CVE-2025-69228 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →