chore(deps): update dependency aiohttp to v3.13.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aiohttp	==3.13.2 → ==3.13.3

GitHub Vulnerability Alerts

CVE-2025-69224

Summary

The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

---

Patch: aio-libs/aiohttp@32677f2

CVE-2025-69223

Summary

A zip bomb can be used to execute a DoS against the aiohttp server.

Impact

An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

---

Patch: aio-libs/aiohttp@2b920c3

CVE-2025-69225

Summary

The parser allows non-ASCII decimals to be present in the Range header.

Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

---

Patch: aio-libs/aiohttp@c7b7a04

CVE-2025-69226

Summary

Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the
existence of absolute path components.

Impact

If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

---

Patch: aio-libs/aiohttp@f2a86fd

CVE-2025-69227

Summary

When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.

Impact

If optimisations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message.

---

Patch: aio-libs/aiohttp@bc1319e

CVE-2025-69228

Summary

A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.

Impact

If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory.

---

Patch: aio-libs/aiohttp@b7dbd35

CVE-2025-69229

Summary

Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.

Impact

If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.

---

Patch: aio-libs/aiohttp@dc3170b
Patch: aio-libs/aiohttp@4ed97a4

CVE-2025-69230

Summary

Reading multiple invalid cookies can lead to a logging storm.

Impact

If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.

---

Patch: aio-libs/aiohttp@64629a0

---

Release Notes

aio-libs/aiohttp (aiohttp)

v3.13.3

Compare Source

===================

This release contains fixes for several vulnerabilities. It is advised to
upgrade as soon as possible.

Bug fixes

• Fixed proxy authorization headers not being passed when reusing a connection, which caused 407 (Proxy authentication required) errors
  -- by :user:GLeurquin.

  Related issues and pull requests on GitHub:
  :issue:2596.

• Fixed multipart reading failing when encountering an empty body part -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11857.

• Fixed a case where the parser wasn't raising an exception for a websocket continuation frame when there was no initial frame in context.

  Related issues and pull requests on GitHub:
  :issue:11862.

Removals and backward incompatible breaking changes

• Brotli and brotlicffi minimum version is now 1.2.
  Decompression now has a default maximum output size of 32MiB per decompress call -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11898.

Packaging updates and notes for downstreams

• Moved dependency metadata from :file:setup.cfg to :file:pyproject.toml per :pep:621
  -- by :user:cdce8p.

  Related issues and pull requests on GitHub:
  :issue:11643.

Contributor-facing changes

• Removed unused update-pre-commit github action workflow -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11689.

Miscellaneous internal changes

• Optimized web server performance when access logging is disabled by reducing time syscalls -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10713.

• Added regression test for cached logging status -- by :user:meehand.

  Related issues and pull requests on GitHub:
  :issue:11778.

---

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎉 This PR is included in version 1.250.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀