CVE-2025-53643

FAUCET Score

CVE-2025-53643 describes a request smuggling vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for Python, affecting versions prior to 3.12.14. This flaw arises from the Python parser's failure to correctly handle HTTP trailer sections, potentially allowing attackers to bypass firewalls or proxy protections if AIOHTTP is running without C extensions or with AIOHTTP_NO_EXTENSIONS enabled. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on integrity, but no impact on confidentiality or availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 3.12.14CPE matchmatch criteria	cpe:2.3:a:aiohttp:aiohttp::::::::

CVSS Data

CVSS version used by this source: 4.0

1.7LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

PRESENT

Privileges Required

NONE

User Interaction

NONE

VS Confidentiality

NONE

VS Integrity

LOW

VS Availability

NONE

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

UNREPORTED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

0.30%

Probability of exploitation in next 30 days

EPSS Percentile

21.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0030 is in the 5th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (27)

github_advisorypatch availablevia nvd_reference

View patch

pippatch availablevia ghsa

Product: aiohttpFixed in: 3.12.14

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed in: automation-controller-0:4.6.25-1.el8ap

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed in: automation-controller-0:4.6.25-1.el9ap

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed in: automation-controller-0:4.7.8-1.el9ap

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.18 for RHEL 9Fixed in: python3.12-aiohttp-0:3.13.3-1.el9pc

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift AI 2.22Fixed in: rhoai/odh-feature-server-rhel9:sha256:d5d52b368050d505183452f1d8b5170c86f7473fd869a886777d3bf7e48aad76

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift AI 2.25Fixed in: rhoai/odh-feature-server-rhel9:sha256:fc53c992d479524272b81b628f62e71236748aece361d40d1fe590a9352f2ff4

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-proxyv2-rhel9:sha256:c57edf0eefcfa85a4934f655481a0d7289ccb86dbdc408f38aaa410e29264644

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Service Mesh 3.1Fixed in: openshift-service-mesh/istio-proxyv2-rhel9:sha256:1530e9b93614fa2136787037bf61979a1a4822827ce548a9aba27412cbc8dbb5

View patch