SB20260216150 - Ubuntu update for python-aiohttp
Published: February 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Improper handling of highly compressed data (CVE-ID: CVE-2025-69223)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the application does not properly handle highly compressed data within the auto_decompress feature. A remote attacker can send a specially crafted compressed HTTP request to the server and consume all available memory resources.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-69224)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of non-ASCII characters within HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks but requires that a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled.
3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-69225)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to the application allows non-ASCII decimals to be present in the Range header. A remote attacker can send a specially crafted HTTP request to the server and potentially smuggle arbitrary HTTP headers.
4) Information disclosure (CVE-ID: CVE-2025-69226)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the web.static() function allows detection of existing path components. A remote non-authenticated attacker can brute-force file names on the system.
5) Infinite loop (CVE-ID: CVE-2025-69227)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the Request.post() method when optimisations are enabled (-O or PYTHONOPTIMIZE=1). A remote attacker send multiple HTTP POST requests to the server and perform a denial of service attack.
6) Resource exhaustion (CVE-ID: CVE-2025-69228)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the Request.post() method. A remote attacker can send large HTTP payloads to the application to trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Resource exhaustion (CVE-ID: CVE-2025-69229)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the request.read() method. A remote attacker can trigger CPU exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.