Back to Database
Status published
Low
CVE-2025-69225
AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields
Vulnerability Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69225
Credits & Attribution
No credits recorded in the NVD database.
References
More from aio-libs
View All →CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
Low
2.7
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Medium
6.6
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
Medium
6.6
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
Medium
6.6
CVE-2025-69226
AIOHTTP allows for a brute-force leak of internal static filepath components
Medium
6.3
Affected Vendor
aio-libs
View all reports →Affected Software
aiohttp
Vulnerable Versions:
< 3.13.3
Timeline
Official Publish:
January 5th, 2026
Last Modified:
January 6th, 2026
Added to House:
July 22nd, 2026