CVE-2025-69227 is a denial of service vulnerability in the aiohttp Python framework. When Python optimizations (e.g., -O or PYTHONOPTIMIZE=1) are enabled, a specially crafted POST request to an application using aiohttp's Request.post() method can cause an infinite loop, leading to resource exhaustion and application unavailability. This affects Red Hat Ansible Automation Platform 2.5 versions >=2.5.0 and <2.6.0. Red Hat has released an updated container image to address this issue. The vulnerability is associated with CWE-835 (Infinite Loop). Exploitation requires specific configuration and usage conditions. No known exploits are reported in the wild.

The vulnerability can cause a denial of service by triggering an infinite loop in applications using aiohttp's Request.post() method with Python optimizations enabled. This results in high resource consumption (CPU and memory), potentially making the affected application unavailable. There is no impact on confidentiality or integrity reported. Exploitation requires no privileges or user interaction but depends on specific application usage and configuration.

Red Hat has released an updated container image for Red Hat Ansible Automation Platform 2.5 that addresses this vulnerability. Users should apply this update after ensuring all previously released errata are applied. No other mitigations meeting Red Hat's standards are currently available. Users are advised to follow Red Hat's official upgrade documentation to apply the fix.