Threats tagged 'brew-vdirsyncer-cve-2025-69224'

CVE-2025-69224 is a medium severity HTTP request smuggling vulnerability in aiohttp versions prior to 3.13.3. It affects the Python HTTP parser when non-ASCII characters are present and the pure Python implementation is used (i.e. , without C extensions or when AIOHTTP_NO_EXTENSIONS is enabled). This flaw allows attackers to bypass certain firewalls or proxy protections by crafting malicious HTTP requests that are inconsistently interpreted by intermediaries and the server. Exploitation does not require authentication or user interaction but does require network access to the vulnerable server. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality and integrity by enabling request smuggling attacks that can lead to unauthorized request execution or data leakage.