GHSA-69f9-5gxw-wvc2Low

AIOHTTP's unicode processing of header values could cause parsing discrepancies

Published
January 5, 2026
Last Modified
January 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-69224 →

📋 Description

Summary

The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0

🎯 Affected products1

  • pip/aiohttp:<= 3.13.2

🔗 References (4)