2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69225

CVE-2025-69225: AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69225

CVE-2025-69225:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.13.2	3.13.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the http_range method of the BaseRequest class in aiohttp/web_request.py. The method is responsible for parsing the HTTP Range header. The original implementation used a regular expression that did not enforce ASCII-only digits, allowing for the use of unicode decimal characters in the range specification. This could lead to a discrepancy in how aiohttp and a backend server interpret the Range header, creating a potential for HTTP request smuggling. The provided patch addresses this by adding the re.ASCII flag to the re.findall function call within http_range, thereby restricting the accepted characters to ASCII digits and mitigating the vulnerability.

Vulnerable functions

BaseRequest.http_range

aiohttp/web_request.py

The `http_range` function in the `BaseRequest` class was vulnerable to improper input validation. It used a regular expression to parse the 'Range' header without restricting it to ASCII characters. This allowed non-ASCII decimal characters to be accepted, which could lead to inconsistent parsing and potential request smuggling vulnerabilities. The patch corrected this by adding the `re.ASCII` flag to the `re.findall` call, ensuring that only ASCII digits are processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.