CVE-2025-69224
AIOHTTP's Unicode processing of header values could cause parsing discrepancies
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
AIOHTTP's Unicode processing of header values could cause parsing discrepancies
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69224- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2026-1048
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
EUVD-2026-1048- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-69f9-5gxw-wvc2
AIOHTTP's unicode processing of header values could cause parsing discrepancies
Summary
The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.
Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
- Record
GHSA-69f9-5gxw-wvc2- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69224- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
ALPINE-CVE-2025-69224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
OSV
AIOHTTP's Unicode processing of header values could cause parsing discrepancies
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
CVE-2025-69224- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
DEBIAN-CVE-2025-69224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-69f9-5gxw-wvc2
AIOHTTP's unicode processing of header values could cause parsing discrepancies
Summary
The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.
Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
- Record
GHSA-69f9-5gxw-wvc2- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVPYSEC-2026-1099
AIOHTTP's unicode processing of header values could cause parsing discrepancies
Summary
The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.
Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
- Record
PYSEC-2026-1099- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-69224
CVE-2025-69224 in aiohttp - Patched by Root
Root has patched CVE-2025-69224 in the aiohttp package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-69224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
UBUNTU-CVE-2025-69224- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-73497 No score
CVE-2025-69224 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
AZL-73497- Updated
- 2026-11-02
OSVAZL-73520 No score
CVE-2025-69224 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
- Record
AZL-73520- Updated
- 2026-11-05
OSVCLSA-2026-1787906503 No score
TuxCare security update for aiohttp (8 CVEs)
TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.
- Record
CLSA-2026-1787906503- Updated
- 2026-11-02
OSVCLSA-2026-1788792738 No score
TuxCare security update for aiohttp (9 CVEs)
TuxCare rebuilt aiohttp to address 9 CVEs. Fixed in 3.8.4.post8+tuxcare.
- Record
CLSA-2026-1788792738- Updated
- 2026-11-02
OSVCLSA-2026-1789132119 No score
TuxCare security update for aiohttp (6 CVEs)
TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.1.post13+tuxcare.
- Record
CLSA-2026-1789132119- Updated
- 2026-11-02
OSVCLSA-2026-1789643644 No score
TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post15+tuxcare.
- Record
CLSA-2026-1789643644- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10025-1 No score
python311-aiohttp-3.13.3-1.1 on GA media
These are all security issues fixed in the python311-aiohttp-3.13.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10025-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20204-1 No score
Security update for python-aiohttp, python-Brotli
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).
Changes in python-Brotli:
- Add max length decompression (bsc#1254867, bsc#1256017).
- Record
openSUSE-SU-2026:20204-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0858-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- Record
SUSE-SU-2026:0858-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0859-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- Record
SUSE-SU-2026:0859-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20425-1 No score
Security update for python-aiohttp, python-Brotli
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).
Changes in python-Brotli:
- Add max length decompression (bsc#1254867, bsc#1256017).
- Record
SUSE-SU-2026:20425-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aiohttpPyPI |
through 3.13.2 | 3.13.3 |
py3-aiohttpAlpine:v3.23 |
before 3.13.3-r0 | 3.13.3-r0 |
py3-aiohttpAlpine:v3.24 |
before 3.13.3-r0 | 3.13.3-r0 |
python-aiohttpAzure Linux:2 |
through 3.6.2-3 | None known |
python-aiohttpAzure Linux:3 |
through 3.6.2-3 | None known |
aiohttpTuxCare:PyPI From an advisory covering 8 CVEs |
3.8.6 up to 3.8.6.post10+tuxcare, plus listed versions 3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare Show 4 moreShow less3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare |
3.8.6.post10+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 9 CVEs |
3.8.4 up to 3.8.4.post8+tuxcare, plus listed versions 3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare |
3.8.4.post8+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 6 CVEs |
3.8.1 up to 3.8.1.post13+tuxcare, plus listed versions 3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post2+tuxcare Show 7 moreShow less3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare |
3.8.1.post13+tuxcare |
aiohttpTuxCare:PyPI |
3.8.5 up to 3.8.5.post15+tuxcare, plus listed versions 3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post12+tuxcare3.8.5.post13+tuxcare Show 9 moreShow less3.8.5.post14+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare |
3.8.5.post15+tuxcare |
python-aiohttpDebian:12 |
before 3.8.4-1+deb12u2, plus listed versions 3.8.4-13.8.4-1+deb12u1 |
3.8.4-1+deb12u2 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-aiohttpDebian:13 |
before 3.11.16-1+deb13u1, plus listed versions 3.11.16-1 |
3.11.16-1+deb13u1 |
python-aiohttpDebian:14 |
before 3.13.3-1, plus listed versions 3.11.16-13.12.15-13.13.0-13.13.1-1 |
3.13.3-1 |
aiohttpPyPI |
before 3.13.3, plus listed versions 0.10.10.00.10.10.10.20.11.0 Show 45 moreShow less0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2 |
3.13.3 |
aiohttpRoot:PyPI |
before 3.10.11+aikido.6 | 3.10.11+aikido.63.10.11+aikido.73.12.14+aikido.33.12.15+aikido.43.12.15+aikido.53.12.15+aikido.63.10.11+aikido.83.12.14+aikido.43.12.14+aikido.53.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.8.6+aikido.103.10.11+aikido.93.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.8.6+aikido.133.12.14+aikido.83.12.15+aikido.73.10.11+aikido.103.12.15+aikido.83.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.12.15+aikido.93.12.14+aikido.93.8.6+aikido.15 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Module for Python 3 15 SP7 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpopenSUSE:Leap 15.6 From an advisory covering 7 CVEs |
before 3.9.3-150400.10.36.1 | 3.9.3-150400.10.36.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 7 CVEs |
before 3.6.0-150100.3.32.1 | 3.6.0-150100.3.32.1 |
python-BrotliSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
python-BrotliSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
python-aiohttpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1 |
None known |
python-aiohttpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1 Show 4 moreShow less3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7 |
None known |
python-aiohttpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1 Show 7 moreShow less3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6 |
None known |
python-aiohttpUbuntu:Pro:22.04:LTS |
before 3.8.1-4ubuntu0.2+esm2, plus listed versions 3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build13.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm1 |
3.8.1-4ubuntu0.2+esm2 |
python-aiohttpUbuntu:Pro:24.04:LTS |
before 3.9.1-1ubuntu0.1+esm2, plus listed versions 3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm1 |
3.9.1-1ubuntu0.1+esm2 |
python-aiohttpUbuntu:25.10 |
before 3.11.16-1ubuntu0.1, plus listed versions 3.10.11-1build13.11.16-1 |
3.11.16-1ubuntu0.1 |
python-aiohttpopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 3.13.3-1.1 | 3.13.3-1.1 |
python-BrotliopenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
python-aiohttpopenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 3.11.16-160000.3.1 | 3.11.16-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69224 is a medium vulnerability (CVSS 6.3) in Aio-libs Aiohttp, published January 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in aiohttp 3.13.3.
References
github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2
nvd.nist.gov/vuln/detail/CVE-2025-69224
security.alpinelinux.org/vuln/CVE-2025-69224
Show 28 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69224
pypi.org/project/aiohttp
suse.com/support/update/announcement/2026/suse-su-20260858-1
bugzilla.suse.com/1256017
ubuntu.com/security/CVE-2025-69224
cve.org/CVERecord?id=CVE-2025-69224
Left out here: 253 versions. The JSON record has them.