Threats tagged 'brew-vdirsyncer-cve-2025-69225'

CVE-2025-69225 is a low-severity HTTP request smuggling vulnerability in aio-libs aiohttp versions prior to 3.13.3. It arises from the parser allowing non-ASCII decimal characters in the HTTP Range header, potentially enabling inconsistent interpretation of HTTP requests. Although no known exploits or impacts have been reported, this flaw could theoretically be leveraged to smuggle HTTP requests, leading to request desynchronization between front-end and back-end servers. The vulnerability is fixed in aiohttp 3.13.3. European organizations using vulnerable aiohttp versions in asynchronous Python web services should upgrade promptly to mitigate risk. Given the low CVSS score and lack of known exploits, the threat is currently low but should not be ignored in sensitive environments.