Executive brief
AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
Affected products
- PyPI aiohttp
Junglewise Threat Intelligence
CVE-2025-53643: PYSEC-2026-1104 - AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
CVE-2025-53643 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: aiohttp (PyPI). Vendors: PyPI.
Related threats
- AIOHTTP out-of-bounds heap read in C HTTP response parser
- AIOHTTP request smuggling in WebSocket upgrade
- aio-libs aiohttp resource exhaustion in WebSocket client decompression
- PYSEC-2026-1106 - AIOHTTP vulnerable to DoS through chunked messages
- PYSEC-2026-1100 - AIOHTTP vulnerable to denial of service through large payloads