CVE-2025-69225: AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields
Summary
The parser allows non-ASCII decimals to be present in the Range header.
Impact
There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.
----
Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69225?
CVE-2025-69225 has not been assigned a specific severity rating as no known exploit has been confirmed.
How do I fix CVE-2025-69225?
To remediate CVE-2025-69225, upgrade aiohttp to version 3.13.3 or later.
What software is affected by CVE-2025-69225?
CVE-2025-69225 affects aiohttp versions up to and including 3.13.2.
What is the potential impact of CVE-2025-69225?
The potential impact of CVE-2025-69225 includes the possibility of request smuggling exploits.
Is there a patch available for CVE-2025-69225?
Yes, a patch for CVE-2025-69225 is available in aiohttp version 3.13.3.