CVE-2025-69224 AIOHTTP's Unicode processing of header values could cause parsing discrepancies
Attackers can bypass firewalls or proxies via request smuggling in AIOHTTP when using pure Python mode or disabled C extensions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69224?
CVE-2025-69224 is a medium-severity vulnerability in aio-libs aiohttp, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
Weakness: CWE-444
Which versions are affected by CVE-2025-69224?
3 open source packages ship an affected version, including aiohttp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.13.3 |
aiohttp PyPI | All versions | 3.13.3 |
aiohttp PyPI | All versions | 3.13.3 |
Products include Aiohttp Aiohttp.
How do I fix CVE-2025-69224?
Upgrade aiohttp to 3.13.3 or later.
Is CVE-2025-69224 being exploited?
There is no known exploitation of CVE-2025-69224 in the wild and no public exploit code.
Other vulnerabilities in aio-libs aiohttp
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Sources
Also known as AZL-73497, AZL-73520, CLEANSTART-2026-KH95361, CLSA-2026-1789643644, DEBIAN-CVE-2025-69224, ECHO-8c97-2de3-38c8 and 6 more.