6.5

CVE-2025-69224: aio-libs aiohttp HTTP Request/Response Smuggling

CVSS: 6.5v3.1MediumAnalyzed
AliasesGHSA-69f9-5gxw-wvc2PYSEC-2026-1099UBUNTU-CVE-2025-69224
Published 05-01-2026Last modified 06-01-2026
Open JSON

Vulnerability summary

CVE-2025-69224 is a medium (CVSS 6.5) HTTP Request/Response Smuggling vulnerability in aio-libs aiohttp. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.25%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 7
OPENSUSE-SU-2026:10025-1OPENSUSE-SU-2026:20204-1SUSE-SU-2026:0858-1SUSE-SU-2026:0859-1SUSE-SU-2026:20425-1CGA-69PV-RRFW-6GHR

Timeline

  1. 05-01-2026
    PublishedVulnerability first disclosed.
  2. 06-01-2026
    Last modifiedVulnerability information updated.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

+0.01 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard22 products
  • airflow-2< 2.11.0-r19
  • airflow-2-bitnami-compat< 2.11.0-r19
  • airflow-2-compat< 2.11.0-r19
  • airflow-2-iamguarded-compat< 2.11.0-r19
  • airflow-3< 3.1.5-r2 | < 3.2.0-r0
Wolfi9 products
  • airflow-3< 3.1.5-r2 | < 3.2.0-r0
  • airflow-3-bitnami-compatAll versions (No fix recorded)
  • checkov< 3.2.499-r0
  • dask-kubernetes< 2025.7.0-r4
  • kserve-storage-controller< 0.17.0-r2
Aio-libs1 product
Aiohttp1 product
Debian1 product
  • python-aiohttpAll versions (No fix recorded) | < 3.11.16-1+deb13u1 | < 3.13.3-1
PyPI1 product
  • aiohttp< 3.13.3
Ubuntu1 product
  • python-aiohttpAll versions (No fix recorded) | < 3.8.1-4ubuntu0.2+esm2 | < 3.9.1-1ubuntu0.1+esm2 | < 3.11.16-1ubuntu0.1

7 vendors · 36 products

References

12 links
Show all 12 references