CVE-2025-69225: 
Wolfi vulnerability analysis and mitigation

CVE-2025-69225 is an HTTP request smuggling vulnerability in the AIOHTTP asynchronous HTTP client/server framework for Python. The flaw exists in the Range header parser, which uses a regex without the re.ASCII flag, allowing non-ASCII decimal characters (e.g., Unicode digits like Devanagari numerals) to be accepted in an ASCII-only protocol field. All versions up to and including 3.13.2 are affected; the issue is fixed in version 3.13.3. It was published on January 5, 2026, with a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Specifically, in aiohttp/web_request.py, the http_range property uses the regex pattern r"^bytes=(\d*)-(\d*)$" without the re.ASCII flag, causing Python's \d to match any Unicode decimal digit rather than only ASCII digits 0–9 (GitHub Commit). An unauthenticated remote attacker can craft an HTTP request with a Range header containing non-ASCII Unicode digits (e.g., bytes=4-५ where ५ is the Devanagari digit five), which aiohttp's parser accepts as valid. The concern is that a downstream proxy or server may interpret the same header differently, creating a desynchronization condition that could enable request smuggling. No authentication or special privileges are required, and no user interaction is needed (GitHub Advisory).

The primary impact is a potential integrity risk: an attacker could craft requests that are parsed inconsistently between aiohttp and upstream/downstream HTTP intermediaries, potentially enabling HTTP request smuggling. If exploitable, this could allow an attacker to poison web caches, bypass security controls, hijack user sessions, or inject malicious content into responses seen by other users. There is no known confidentiality or availability impact, and the vendor acknowledges no confirmed exploitation method has been demonstrated (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or in-the-wild exploitation has been reported for CVE-2025-69225. The EPSS score is approximately 0.042% (13th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated "UNREPORTED," and the advisory itself states there is no known impact or confirmed exploitation method (GitHub Advisory).

The fix is available in aiohttp version 3.13.3, released January 5, 2026. The patch modifies the http_range property in aiohttp/web_request.py to pass the re.ASCII flag to re.findall(), ensuring only ASCII digits are accepted in the Range header (commit c7b7a04). Users should upgrade to aiohttp 3.13.3 or later as soon as possible. No configuration-based workaround is documented; upgrading is the recommended remediation (GitHub Commit, GitHub Advisory). IBM has also issued advisories for affected products including watsonx Orchestrate Developer Edition, Guardium Data Security Center, and Instana Observability (IBM Advisory, IBM Instana).

The vulnerability was reported by security researcher ThomasRinsma and remediated by Dreamsorcerer (Sam Bull) of the aiohttp maintainer team (GitHub Advisory). Security Online Info noted the release as part of a broader aiohttp patch addressing seven vulnerabilities including higher-severity DoS risks. Linux distribution maintainers for openSUSE, Ubuntu, Debian, and SUSE have issued security updates incorporating the fix. Splunk also published advisories referencing this CVE in the context of their products.