CVE-2025-69224Medium· 6.5▾ SunlitAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 6.5
low → medium
0.2% → 0.3%
Last analysed / modified upstream
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
aiohttp < 3.13.3Upgrade past the affected range:
aiohttp 3.13.3Affected packages:
aiohttp < 3.13.3Patched in:
aiohttp 3.13.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
CVE-2025-69225Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use