CVE-2025-69223
published 2026-01-05CVE-2025-69223: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.49%
38.8th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.3 | 3.13.3 |
| aiohttp | aiohttp | < 3.13.3 | 3.13.3 |
| aiohttp | aiohttp | >= 0 < 3.13.3 | 3.13.3 |
| debian | python-aiohttp | < python-aiohttp 3.13.3-1 (forky) | python-aiohttp 3.13.3-1 (forky) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.13.2 data amplification (GHSA-6mq8-rvhq-8wgg / EUVD-2025-206229)
vuldb·2026-04-15·CVSS 7.5
CVE-2025-69223 [HIGH] aio-libs aiohttp up to 3.13.2 data amplification (GHSA-6mq8-rvhq-8wgg / EUVD-2025-206229)
A vulnerability classified as critical was found in aio-libs aiohttp up to 3.13.2. The affected element is an unknown function. Executing a manipulation can lead to highly compressed data.
This vulnerability appears as CVE-2025-69223. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
OSV
python-aiohttp vulnerabilities
osv·2026-02-13·CVSS 7.5
CVE-2025-69223 [HIGH] python-aiohttp vulnerabilities
python-aiohttp vulnerabilities
Charles Chan discovered that AIOHTTP incorrectly handled the decompression
of compressed requests. A remote attacker could possibly use this issue to
cause a denial of service. This issue was only addressed in Ubuntu 25.10.
(CVE-2025-69223)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in HTTP headers. A remote attacker could possibly use this issue
to perform a request smuggling attack to bypass certain proxy protections.
This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. (CVE-2025-69224)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in the Range header. A remote attacker could possibly use this
issue to perform a request smuggling attack. (CVE-2025-69225)
OSV
CVE-2025-69223: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-01-05·CVSS 7.5
CVE-2025-69223 [HIGH] CVE-2025-69223: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
OSV
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
osv·2026-01-05
CVE-2025-69223 [HIGH] AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
### Summary
A zip bomb can be used to execute a DoS against the aiohttp server.
### Impact
An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.
Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
GHSA
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
ghsa·2026-01-05
CVE-2025-69223 [HIGH] CWE-409 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
### Summary
A zip bomb can be used to execute a DoS against the aiohttp server.
### Impact
An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.
Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2026-02-13·CVSS 7.5
CVE-2025-69225 [HIGH] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Charles Chan discovered that AIOHTTP incorrectly handled the decompression
of compressed requests. A remote attacker could possibly use this issue to
cause a denial of service. This issue was only addressed in Ubuntu 25.10.
(CVE-2025-69223)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in HTTP headers. A remote attacker could possibly use this issue
to perform a request smuggling attack to bypass certain proxy protections.
This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. (CVE-2025-69224)
Thomas Rinsma discovered that AIOHTTP incorrectly handled non-ASCII
characters in the Range header. A remote attacker could possibly use this
issu
Red Hat
aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
vendor_redhat·2026-01-05·CVSS 7.5
CVE-2025-69223 [HIGH] CWE-770 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
A decompression based denial of service flaw has been discovered in the AIOHTTP python library. Library versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory.
Mitigation: Mitigation for this issue is either not ava
Debian
CVE-2025-69223: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2025·CVSS 7.5
CVE-2025-69223 [HIGH] CVE-2025-69223: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.13.3-1)
sid: resolved (fixed in 3.13.3-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-69223 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-69223 [HIGH] CVE-2025-69223 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69223 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Source : NVD
## 7.5
Score
Published January 5, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.6
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python-aiohttp
checkov
Sources
NVD
Alpine 3.
Bugzilla
CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
bugzilla·2026-01-06·CVSS 7.5
CVE-2025-69223 [HIGH] CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Discussion:
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 10
Via RHSA-2026:1249 https://access.redhat.com/errata/RHSA-2026:1249
---
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.4 for RHEL 8
Red Hat
https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138ahttps://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgghttps://access.redhat.com/errata/RHSA-2026:10184https://access.redhat.com/errata/RHSA-2026:1249https://access.redhat.com/errata/RHSA-2026:1497https://access.redhat.com/errata/RHSA-2026:1506https://access.redhat.com/errata/RHSA-2026:1596https://access.redhat.com/errata/RHSA-2026:1599https://access.redhat.com/errata/RHSA-2026:1609https://access.redhat.com/errata/RHSA-2026:19712https://access.redhat.com/errata/RHSA-2026:2106https://access.redhat.com/errata/RHSA-2026:2695https://access.redhat.com/errata/RHSA-2026:3461https://access.redhat.com/errata/RHSA-2026:3462https://access.redhat.com/errata/RHSA-2026:3713https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:3782https://access.redhat.com/errata/RHSA-2026:3958https://access.redhat.com/errata/RHSA-2026:3959https://access.redhat.com/errata/RHSA-2026:3960https://access.redhat.com/errata/RHSA-2026:6308https://access.redhat.com/errata/RHSA-2026:6309https://access.redhat.com/security/cve/CVE-2025-69223https://bugzilla.redhat.com/show_bug.cgi?id=2427456https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json
2026-01-05
Published