Every CVE Search/ Get API key

CVE-2025-69225

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

2.7 LowFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.28%Up 0.2 points since Jan 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.7

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
CVE-2025-69225
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-1047 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
EUVD-2026-1047
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-mqqc-3gqh-h2x8 2.7

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Summary

The parser allows non-ASCII decimals to be present in the Range header.

Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

Record
GHSA-mqqc-3gqh-h2x8
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
NVD 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
CVE-2025-69225
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2025-69225 5.3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
ALPINE-CVE-2025-69225
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSV 2.7

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
CVE-2025-69225
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
Show 17 moreShow less
OSVDEBIAN-CVE-2025-69225 5.3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
DEBIAN-CVE-2025-69225
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGHSA-mqqc-3gqh-h2x8 2.7

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Summary

The parser allows non-ASCII decimals to be present in the Range header.

Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

Record
GHSA-mqqc-3gqh-h2x8
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-444
Updated
2026-11-02
OSVOESA-2026-1682 6.6

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.(CVE-2025-69225)

aiohttp contains a denial-of-service vulnerability when bypassing asserts, allowing attackers to bypass assertion checks through specific methods leading to service unavailability.(CVE-2025-69227)

aiohttp contains a vulnerability when processing large payloads. An attacker can craft large requests to exhaust server resources, leading to denial of service.(CVE-2025-69228)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of small chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g., 1 second) while processing the request. This could potentially lead to a Denial of Service (DoS) as the server would be unable to handle other requests during that time.(CVE-2025-69229)

Record
OESA-2026-1682
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVPYSEC-2026-1109 2.7

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Summary

The parser allows non-ASCII decimals to be present in the Range header.

Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

Record
PYSEC-2026-1109
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-69225 5.3

CVE-2025-69225 in aiohttp - Patched by Root

Root has patched CVE-2025-69225 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-69225
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-69225 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
UBUNTU-CVE-2025-69225
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-73500 No score

CVE-2025-69225 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
AZL-73500
Updated
2026-11-02
OSVAZL-73523 No score

CVE-2025-69225 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

Record
AZL-73523
Updated
2026-11-05
OSVCLSA-2026-1787915974 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post11+tuxcare.

Record
CLSA-2026-1787915974
Updated
2026-11-02
OSVCLSA-2026-1788792738 No score

TuxCare security update for aiohttp (9 CVEs)

TuxCare rebuilt aiohttp to address 9 CVEs. Fixed in 3.8.4.post8+tuxcare.

Record
CLSA-2026-1788792738
Updated
2026-11-02
OSVCLSA-2026-1788866911 No score

TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare.

Record
CLSA-2026-1788866911
Updated
2026-11-02
OSVCLSA-2026-1789132119 No score

TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.1.post13+tuxcare.

Record
CLSA-2026-1789132119
Updated
2026-11-02
OSVopenSUSE-SU-2026:10025-1 No score

python311-aiohttp-3.13.3-1.1 on GA media

These are all security issues fixed in the python311-aiohttp-3.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10025-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20204-1 No score

Security update for python-aiohttp, python-Brotli

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
  • CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

  • Add max length decompression (bsc#1254867, bsc#1256017).
Record
openSUSE-SU-2026:20204-1
Updated
2026-11-02
OSVSUSE-SU-2026:0858-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
Record
SUSE-SU-2026:0858-1
Updated
2026-11-02
OSVSUSE-SU-2026:0859-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
Record
SUSE-SU-2026:0859-1
Updated
2026-11-02
OSVSUSE-SU-2026:20425-1 No score

Security update for python-aiohttp, python-Brotli

This update for python-aiohttp, python-Brotli fixes the following issues:

Changes in python-aiohttp:

  • CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
  • CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
  • CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
  • CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
  • CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
  • CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
  • CVE-2025-69229: Fixed DoS through chunked messages (bsc#1256023).
  • CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517).

Changes in python-Brotli:

  • Add max length decompression (bsc#1254867, bsc#1256017).
Record
SUSE-SU-2026:20425-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 through 3.13.2
3.13.3
py3-aiohttp
Alpine:v3.23
 before 3.13.3-r0
3.13.3-r0
py3-aiohttp
Alpine:v3.24
 before 3.13.3-r0
3.13.3-r0
python-aiohttp
Azure Linux:2
 through 3.6.2-3 None known
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.6 up to 3.8.6.post11+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post10+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare
Show 5 moreShow less
3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare
3.8.6.post11+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 9 CVEs
 3.8.4 up to 3.8.4.post8+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare
3.8.4.post8+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 6 CVEs
 3.8.5 up to 3.8.5.post12+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare
Show 6 moreShow less
3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post12+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 6 CVEs
 3.8.1 up to 3.8.1.post13+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post2+tuxcare
Show 7 moreShow less
3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare
3.8.1.post13+tuxcare
python-aiohttp
Debian:12
 before 3.8.4-1+deb12u2, plus listed versions
3.8.4-13.8.4-1+deb12u1
3.8.4-1+deb12u2
Show 38 moreShow less
Affected packages
PackageAffectedFixed
python-aiohttp
Debian:13
 before 3.11.16-1+deb13u1, plus listed versions
3.11.16-1
3.11.16-1+deb13u1
python-aiohttp
Debian:14
 before 3.13.3-1, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-1
3.13.3-1
aiohttp
PyPI
 before 3.13.3, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.13.3
python-aiohttp
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 3.9.3-9.oe2403sp1
3.9.3-9.oe2403sp1
python-aiohttp
openEuler:24.03-LTS-SP2
From an advisory covering 4 CVEs
 before 3.9.3-9.oe2403sp2
3.9.3-9.oe2403sp2
python-aiohttp
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 3.9.3-9.oe2403sp3
3.9.3-9.oe2403sp3
python-aiohttp
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.7.4-6.oe2003sp4
3.7.4-6.oe2003sp4
python-aiohttp
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.7.4-7.oe2203sp4
3.7.4-7.oe2203sp4
python-aiohttp
openEuler:24.03-LTS
From an advisory covering 4 CVEs
 before 3.9.3-9.oe2403
3.9.3-9.oe2403
aiohttp
Root:PyPI
 before 3.10.11+aikido.4
3.10.11+aikido.43.10.11+aikido.53.10.11+aikido.63.10.11+aikido.73.12.14+aikido.33.12.15+aikido.53.12.15+aikido.63.10.11+aikido.83.12.14+aikido.43.8.6+aikido.43.12.14+aikido.53.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.8.6+aikido.103.10.11+aikido.93.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.8.6+aikido.133.12.14+aikido.83.12.15+aikido.73.10.11+aikido.103.12.15+aikido.83.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.12.15+aikido.93.12.14+aikido.93.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 3.9.3-150400.10.36.1
3.9.3-150400.10.36.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 7 CVEs
 before 3.6.0-150100.3.32.1
3.6.0-150100.3.32.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 7 CVEs
 before 3.6.0-150100.3.32.1
3.6.0-150100.3.32.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 7 CVEs
 before 3.6.0-150100.3.32.1
3.6.0-150100.3.32.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 7 CVEs
 before 3.6.0-150100.3.32.1
3.6.0-150100.3.32.1
python-Brotli
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1
python-Brotli
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1
python-aiohttp
Ubuntu:Pro:18.04:LTS
 before 3.0.1-1ubuntu0.1~esm6, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm13.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm5
3.0.1-1ubuntu0.1~esm6
python-aiohttp
Ubuntu:Pro:22.04:LTS
 before 3.8.1-4ubuntu0.2+esm2, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build13.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm1
3.8.1-4ubuntu0.2+esm2
python-aiohttp
Ubuntu:Pro:24.04:LTS
 before 3.9.1-1ubuntu0.1+esm2, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm1
3.9.1-1ubuntu0.1+esm2
python-aiohttp
Ubuntu:25.10
 before 3.11.16-1ubuntu0.1, plus listed versions
3.10.11-1build13.11.16-1
3.11.16-1ubuntu0.1
python-aiohttp
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 3.13.3-1.1
3.13.3-1.1
python-Brotli
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 1.1.0-160000.3.1
1.1.0-160000.3.1
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.3.1
3.11.16-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-69225 is a low vulnerability (CVSS 2.7) in Aio-libs Aiohttp, published January 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in aiohttp 3.13.3.

References

Show 31 moreShow less
This page doesn't list everything

Left out here: 253 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open