CVE-2025-69224

mediumpriority · track · 26EPSS 0.003 · 16 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.25% (16th) EPSS
CVSS 6.5 · medium
Is it mine?
6 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise Module for Python 3 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.aarch64 as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of SUSE Linux Enterprise Module for Python 3 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.ppc64le as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of SUSE Linux Enterprise Module for Python 3 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.s390x as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise Module for Python 3 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.9.3-150400.10.36.1.x86_64 as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython3-aiohttp-0:3.6.0-150100.3.32.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.13.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.13.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.13.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython311-aiohttp-0:3.13.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython312-aiohttp-0:3.13.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython312-aiohttp-0:3.13.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython312-aiohttp-0:3.13.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython312-aiohttp-0:3.13.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.13.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.13.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.13.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.13.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.aarch64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.ppc64le as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.s390x as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-Brotli-0:1.1.0-160000.3.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.aarch64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.ppc64le as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.s390x as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedpython313-aiohttp-0:3.11.16-160000.3.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

6.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.5
v3.16.5mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · SUSE Product Security
v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.01.7lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-444USCWE-444USCWE-444US
05

affected products (6)

Products and version ranges known to be affected.

06

advisories (7)

Vendor and ecosystem advisories describing this.

  • SUSE-SU-2026:0858-1Security update for python-aiohttp2026-03-10csaf · suse_csafDE

    Security update for python-aiohttp

  • SUSE-SU-2026:0859-1Security update for python-aiohttp2026-03-10csaf · suse_csafDE

    Security update for python-aiohttp

  • SUSE-SU-2026:20425-1Security update for python-aiohttp, python-Brotli2026-02-12csaf · suse_csafDE

    Security update for python-aiohttp, python-Brotli

  • openSUSE-SU-2026:10025-1python311-aiohttp-3.13.3-1.1 on GA media2026-01-09csaf · suse_csafDE

    python311-aiohttp-3.13.3-1.1 on GA media

  • openSUSE-SU-2026:20204-1Security update for python-aiohttp, python-Brotli2026-02-12csaf · suse_csafDE

    Security update for python-aiohttp, python-Brotli

  • GHSA-69f9-5gxw-wvc2AIOHTTP's unicode processing of header values could cause parsing discrepancies2026-01-05ghsa · osvUS

    ### Summary The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. ### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. ------ Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0

  • PYSEC-2026-1099AIOHTTP's unicode processing of header values could cause parsing discrepancies2026-07-07vendor · osvUS

    ### Summary The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. ### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. ------ Patch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0

07

also known as (7)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvnvdsuse_csafNVDCVE.orgMITRE
published 2026-01-05modified 2026-10-11
09

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan