{"id":"CVE-2025-69224","aliases":["GHSA-69f9-5gxw-wvc2","PYSEC-2026-1099"],"title":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","severity":"low","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.13.3"],"patched":["aiohttp 3.13.3"],"published":"2026-01-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:54.440954011Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-69f9-5gxw-wvc2","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["osv","pip"],"epss":0.00244,"epssPercentile":0.1592,"ingestedAt":"2026-07-08T18:25:46.320Z","slug":"CVE-2025-69224","body":"## Overview\n\n### Summary\nThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0\n\n## Affected packages\n\n- `aiohttp < 3.13.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.13.3`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}