https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T19:19:18.877983+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07209 bdu:2026-07209 2026-10-10T19:19:18.903033+00:00 bdu:2026-07209 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69225 BREW-aider-CVE-2025-69225 — AIOHTTP has unicode match groups in regexes for ASCII protocol elements 2026-10-10T19:19:18.903070+00:00

Affected: Homebrew: aider

### Summary

The parser allows non-ASCII decimals to be present in the Range header.

### Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

----

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-10T19:19:18.903108+00:00 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-10T19:19:18.903126+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-264983 EUVD-2026-264983 2026-10-10T19:19:18.903153+00:00 EUVD-2026-264983 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69225 fkie_cve-2025-69225 2026-10-10T19:19:18.903164+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

 https://cve.radiocsirt.org/vuln/ghsa-mqqc-3gqh-h2x8 GHSA-mqqc-3gqh-h2x8 — AIOHTTP has unicode match groups in regexes for ASCII protocol elements 2026-10-10T19:19:18.903192+00:00

Affected: PyPI: aiohttp

### Summary

The parser allows non-ASCII decimals to be present in the Range header.

### Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

----

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

 https://cve.radiocsirt.org/vuln/oesa-2026-1682 OESA-2026-1682 — python-aiohttp security update 2026-10-10T19:19:18.903227+00:00

Affected: openEuler:24.03-LTS-SP1: python-aiohttp, openEuler:24.03-LTS-SP2: python-aiohttp, openEuler:24.03-LTS-SP3: python-aiohttp, openEuler:20.03-LTS-SP4: python-aiohttp, openEuler:22.03-LTS-SP4: python-aiohttp, openEuler:24.03-LTS: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.(CVE-2025-69225)

aiohttp contains a denial-of-service vulnerability when bypassing asserts, allowing attackers to bypass assertion checks through specific methods leading to service unavailability.(CVE-2025-69227)

aiohttp contains a vulnerability when processing large payloads. An attacker can craft large requests to exhaust server resources, leading to denial of service.(CVE-2025-69228)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of small chunks. If an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g., 1 second) while processing the request. This could potentially lead to a Denial of Service (DoS) as the server would be unable to handle other requests during that time.(CVE-2025-69229)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 openSUSE-SU-2026:10025-1 — python311-aiohttp-3.13.3-1.1 on GA media 2026-10-10T19:19:18.903265+00:00

python311-aiohttp-3.13.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1109 PYSEC-2026-1109 — AIOHTTP has unicode match groups in regexes for ASCII protocol elements 2026-10-10T19:19:18.903285+00:00

Affected: PyPI: aiohttp

### Summary

The parser allows non-ASCII decimals to be present in the Range header.

### Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

----

Patch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96

 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 SUSE-SU-2026:20425-1 — Security update for python-aiohttp, python-Brotli 2026-10-10T19:19:18.903306+00:00

Security update for python-aiohttp, python-Brotli

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69225 UBUNTU-CVE-2025-69225 2026-10-10T19:19:18.903323+00:00

Affected: Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.