CVE-2025-69223

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
References
Link Resource
https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a Patch
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:1249
https://access.redhat.com/errata/RHSA-2026:1497
https://access.redhat.com/errata/RHSA-2026:1506
https://access.redhat.com/errata/RHSA-2026:1596
https://access.redhat.com/errata/RHSA-2026:1599
https://access.redhat.com/errata/RHSA-2026:1609
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:2106
https://access.redhat.com/errata/RHSA-2026:2695
https://access.redhat.com/errata/RHSA-2026:3461
https://access.redhat.com/errata/RHSA-2026:3462
https://access.redhat.com/errata/RHSA-2026:3713
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:3782
https://access.redhat.com/errata/RHSA-2026:3958
https://access.redhat.com/errata/RHSA-2026:3959
https://access.redhat.com/errata/RHSA-2026:3960
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:59155
https://access.redhat.com/errata/RHSA-2026:59159
https://access.redhat.com/errata/RHSA-2026:61628
https://access.redhat.com/errata/RHSA-2026:6308
https://access.redhat.com/errata/RHSA-2026:6309
https://access.redhat.com/security/cve/CVE-2025-69223
https://bugzilla.redhat.com/show_bug.cgi?id=2427456
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) AIOHTTP es un framework asíncrono de cliente/servidor HTTP para asyncio y Python. Las versiones 3.13.2 e inferiores permiten que se utilice una bomba zip para ejecutar un DoS contra el servidor AIOHTTP. Un atacante podría enviar una solicitud comprimida que, al ser descomprimida por AIOHTTP, podría agotar la memoria del host. Este problema está solucionado en la versión 3.13.3.

Information

Published : 2026-01-05 22:15

Updated : 2026-10-11 20:10


NVD link : CVE-2025-69223

Mitre link : CVE-2025-69223

CVE.ORG link : CVE-2025-69223


JSON object : View

Products Affected

aiohttp

  • aiohttp
CWE
CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

CWE-770

Allocation of Resources Without Limits or Throttling