CVE-2025-69225 AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

What is CVE-2025-69225?

CVE-2025-69225 is a low-severity vulnerability in aio-libs aiohttp, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Weakness: CWE-444

Which versions are affected by CVE-2025-69225?

3 open source packages ship an affected version, including aiohttp. It affects 1 product.

Products include Aiohttp Aiohttp.

How do I fix CVE-2025-69225?

Upgrade aiohttp to 3.13.3 or later.

Is CVE-2025-69225 being exploited?

There is no known exploitation of CVE-2025-69225 in the wild and no public exploit code.

Other vulnerabilities in aio-libs aiohttp

• CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method High 8.7
• CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb High 7.5
• CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp High 7.5
• CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version High 7.2
• CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-73500, AZL-73523, CLEANSTART-2026-WU08631, DEBIAN-CVE-2025-69225, ECHO-f48e-4a57-79f6, GHSA-mqqc-3gqh-h2x8 and 5 more.