CVE-2025-69225: AIOHTTP Range Header Vulnerability with Unicode Match Groups
Summary
CVE-2025-69225: AIOHTTP has unicode match groups in regexes for ASCII protocol elements. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Also tracked for
The same CVE-2025-69225 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle both client and server-side web applications. It provides a simple and efficient way to work with HTTP protocols, allowing developers to build scalable web applications. However, it has been identified that the parser allows non-ASCII decimals to be present in the Range header, which could lead to potential security issues.
Vulnerability Detail
The vulnerability arises from the handling of the Range header in AIOHTTP, where the parser permits non-ASCII decimal values. Although there is no known immediate impact, this could potentially lead to request smuggling vulnerabilities, where an attacker might exploit the parsing behavior to manipulate requests in a way that could bypass security measures or lead to unintended behavior in the application.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the fixed version as described above.
Conclusion
In summary, CVE-2025-69225 is a vulnerability in the AIOHTTP package that allows non-ASCII decimals in the Range header, which could potentially lead to request smuggling. It is crucial to update to version 3.13.3 or later to mitigate this risk.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2025-69225 is a vulnerability in the AIOHTTP package that allows non-ASCII decimals in the Range header, potentially leading to request smuggling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is advisable to monitor your application closely and plan for an update as soon as possible.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can find more information about AIOHTTP on its official documentation page or its GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
