{"id":"CVE-2025-69224","title":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-444"],"vendor":"aiohttp","product":"aiohttp","affected":["aiohttp < 3.13.3"],"patched":["aiohttp 3.13.3"],"published":"2026-01-05","updated":"2026-10-11","sourceUpdated":"2026-10-11T20:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224","references":[{"url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0","label":"security-advisories@github.com"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["nvd","osv","pip"],"epss":0.0025,"epssPercentile":0.16258,"aliases":["GHSA-69f9-5gxw-wvc2","PYSEC-2026-1099"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:46.320Z","slug":"CVE-2025-69224","body":"## Overview\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.\n\n## Affected\n\n- `aiohttp < 3.13.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `aiohttp 3.13.3`\n\n## Package advisory (CVE-2025-69224)\n\nAffected packages:\n\n- `aiohttp < 3.13.3`\n\nPatched in:\n\n- `aiohttp 3.13.3`\n\nSource: https://osv.dev/vulnerability/GHSA-69f9-5gxw-wvc2","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214047,"id":"CVE-2025-69224","ts":1790807289487,"field":"cvss","old":null,"new":"6.5"},{"seq":214046,"id":"CVE-2025-69224","ts":1790807289487,"field":"severity","old":"low","new":"medium"}]}