{"id":"CVE-2025-69225","title":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-444"],"vendor":"aiohttp","product":"aiohttp","affected":["aiohttp < 3.13.3"],"patched":["aiohttp 3.13.3"],"published":"2026-01-06","updated":"2026-10-11","sourceUpdated":"2026-10-11T20:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225","references":[{"url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96","label":"security-advisories@github.com"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["nvd","osv","pip"],"epss":0.00282,"epssPercentile":0.20611,"aliases":["GHSA-mqqc-3gqh-h2x8","PYSEC-2026-1109"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:51.425Z","slug":"CVE-2025-69225","body":"## Overview\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.\n\n## Affected\n\n- `aiohttp < 3.13.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `aiohttp 3.13.3`\n\n## Package advisory (CVE-2025-69225)\n\nAffected packages:\n\n- `aiohttp < 3.13.3`\n\nPatched in:\n\n- `aiohttp 3.13.3`\n\nSource: https://osv.dev/vulnerability/GHSA-mqqc-3gqh-h2x8","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214051,"id":"CVE-2025-69225","ts":1790807290016,"field":"cvss","old":null,"new":"5.3"},{"seq":214050,"id":"CVE-2025-69225","ts":1790807290016,"field":"severity","old":"low","new":"medium"}]}