CVE-2025-69224

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below

Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, may be susceptible to a request smuggling attack when using versions 3.13.2 and below. This issue arises from the presence of non-ASCII characters in the Python HTTP parser. If AIOHTTP is installed in a pure Python environment (without C extensions) or with the AIOHTTP NO EXTENSIONS option enabled, an attacker might be able to bypass firewall or proxy protections through this request smuggling attack.

Recommendations Update to AIOHTTP version 3.13.3 or later.