CVE-2025-69227

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

We have discovered 230 live websites that are affected by CVE-2025-69227.

Run a Free Instant Scan



Affected Software

Product  AIOHTTP
Category Miscellaneous
Vulnerable Domains230 live websites (80% of AIOHTTP install base)
Vulnerable Versions
  • from 0 through 3.13.3
Vulnerable Versions Count16 versions ( 80% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Jan 5, 2026
  • Updated - Jan 6, 2026

Website Distribution by Country

Number of websites using CVE-2025-69227
United States95 websites


Germany80 websites
Finland12 websites
India7 websites
Singapore6 websites
Russia5 websites
Spain4 websites
France4 websites
GB4 websites
Czech Republic3 websites

Website Distribution by TLD

Number of websites using CVE-2025-69227
.com93 websites
.fi32 websites
.de17 websites
.net15 websites
.org8 websites
.ca6 websites
.co.uk4 websites
.ru4 websites
.info3 websites
.co2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-69227

Top websites that are affected by CVE-2025-69227. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com Germany**,***
******.*****.fi United States***,***
********.***.de Germany***,***
******************.de Germany***,***
****.al United States***,***
******.************.fi United States***,***
*******************.com Germany***,***
****.bz United States***,***
****.lc United States***,***
******************.at Austria***,***
See full domain list

FAQ

CVE-2025-69227 is Loop with Unreachable Exit Condition ('Infinite Loop') in AIOHTTP
A total of 230 websites have been identified as vulnerable to CVE-2025-69227, based on global website indexing conducted by WebTechSurvey.
The AIOHTTP is affected by the CVE-2025-69227 vulnerability.
AIOHTTP versions up to 3.13.3 are vulnerable to CVE-2025-69227.
CVE-2025-69227 is resolved in version 3.13.3 of AIOHTTP.