CVE-2025-69225

🗓️ 06 Jan 2026 07:28:16Reported by redhat.comType

CVE-2025-69225 in aiohttp allows non-ASCII characters in Range header, enabling request smuggling and data breach.

Reporter	Title	Published	Views	Family All 62
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	25 May 202618:49	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	26 Feb 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for February 2026	26 Feb 202609:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses node-forge-1.3.1.tgz,aiohttp-3.13.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl and WebSphere Application Server v.25.0.0.10 which is vulnerable to multiple CVEs.	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in AIOHTTP bundled with IBM Fusion Content-Aware Storage.	25 Mar 202613:12	–	ibm
AlpineLinux	CVE-2025-69225	5 Jan 202623:16	–	alpinelinux
Chainguard	CVE-2025-69225 vulnerabilities	7 Jan 202619:17	–	cgr
Circl	CVE-2025-69225	6 Jan 202600:32	–	circl
CNNVD	aiohttp 环境问题漏洞	6 Jan 202600:00	–	cnnvd

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-69225
github	www.github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

06 Jan 2026 07:28Current

6.2Medium risk

Vulners AI Score6.2

CVSS 46.9

CVSS 3.15.4

EPSS0.00031

SSVC