Wind River Support Network

HomeDefectsLIN1025-7353

Fixed

LIN1025-7353 : Security Advisory - python3-aiohttp - CVE-2025-69226

Created: Jan 5, 2026 Updated: May 31, 2026

Resolved Date: May 31, 2026

Found In Version: 10.25.33.2

Fix Version: 10.25.33.10

Severity: Standard

Applicable for: Wind River Linux LTS 25

Component/s: Userspace

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

CVEs

CVE-2025-69226