CVE-2025-69226
published 2026-01-05CVE-2025-69226: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.31%
23.5th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.3 | 3.13.3 |
| aiohttp | aiohttp | < 3.13.3 | 3.13.3 |
| aiohttp | aiohttp | >= 0 < 3.13.3 | 3.13.3 |
| debian | python-aiohttp | < python-aiohttp 3.13.3-1 (forky) | python-aiohttp 3.13.3-1 (forky) |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-aiohttp vulnerabilities
osv·2026-02-13·CVSS 7.5
CVE-2025-69223 [HIGH] python-aiohttp vulnerabilities
python-aiohttp vulnerabilities
Charles Chan discovered that AIOHTTP incorrectly handled the decompression
of compressed requests. A remote attacker could possibly use this issue to
cause a denial of service. This issue was only addressed in Ubuntu 25.10.
(CVE-2025-69223)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in HTTP headers. A remote attacker could possibly use this issue
to perform a request smuggling attack to bypass certain proxy protections.
This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. (CVE-2025-69224)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in the Range header. A remote attacker could possibly use this
issue to perform a request smuggling attack. (CVE-2025-69225)
GHSA
AIOHTTP vulnerable to brute-force leak of internal static file path components
ghsa·2026-01-05
CVE-2025-69226 [LOW] CWE-202 AIOHTTP vulnerable to brute-force leak of internal static file path components
AIOHTTP vulnerable to brute-force leak of internal static file path components
### Summary
Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the
existence of absolute path components.
### Impact
If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.
Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
OSV
CVE-2025-69226: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-01-05·CVSS 6.3
CVE-2025-69226 [MEDIUM] CVE-2025-69226: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
OSV
AIOHTTP vulnerable to brute-force leak of internal static file path components
osv·2026-01-05
CVE-2025-69226 [LOW] AIOHTTP vulnerable to brute-force leak of internal static file path components
AIOHTTP vulnerable to brute-force leak of internal static file path components
### Summary
Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the
existence of absolute path components.
### Impact
If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.
Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2026-02-13·CVSS 7.5
CVE-2025-69225 [HIGH] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Charles Chan discovered that AIOHTTP incorrectly handled the decompression
of compressed requests. A remote attacker could possibly use this issue to
cause a denial of service. This issue was only addressed in Ubuntu 25.10.
(CVE-2025-69223)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in HTTP headers. A remote attacker could possibly use this issue
to perform a request smuggling attack to bypass certain proxy protections.
This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. (CVE-2025-69224)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in the Range header. A remote attacker could possibly use this
issu
Red Hat
aiohttp: aiohttp: Information disclosure of path components via static file path normalization
vendor_redhat·2026-01-05·CVSS 6.3
CVE-2025-69226 [MEDIUM] CWE-22 aiohttp: aiohttp: Information disclosure of path components via static file path normalization
aiohttp: aiohttp: Information disclosure of path components via static file path normalization
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. An attacker can exploit a vulnerability in the path normalization logic for static files to determine if specific absolute path components exist on
Debian
CVE-2025-69226: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2025·CVSS 6.3
CVE-2025-69226 [MEDIUM] CVE-2025-69226: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.13.3-1)
sid: resolved (fixed in 3.13.3-1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-69226 aiohttp: aiohttp: Information disclosure of path components via static file path normalization
bugzilla·2026-01-05·CVSS 6.3
CVE-2025-69226 [MEDIUM] CVE-2025-69226 aiohttp: aiohttp: Information disclosure of path components via static file path normalization
CVE-2025-69226 aiohttp: aiohttp: Information disclosure of path components via static file path normalization
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Wiz
CVE-2025-69226 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-69226 [MEDIUM] CVE-2025-69226 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69226 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Source : NVD
## 6.3
Score
Published January 5, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percenti
2026-01-05
Published