CVE-2025-69225: AIOHTTP has unicode match groups in regexes for ASCII protocol elements

January 5, 2026 (updated January 6, 2026)

The parser allows non-ASCII decimals to be present in the Range header.

References

github.com/advisories/GHSA-mqqc-3gqh-h2x8
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96
github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8
nvd.nist.gov/vuln/detail/CVE-2025-69225

Code Behaviors & Features

Detect and mitigate CVE-2025-69225 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →