AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Summary

CVECVE-2025-69223
StatePUBLISHED
AssignerGitHub_M
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-01-05 22:15:53 UTC
Updated2026-07-21 12:17:13 UTC
DescriptionAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.004870000 probability, percentile 0.388080000 (date 2026-07-21)

Problem Types: CWE-409 | CWE-770 | CWE-409 CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) | CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling | CWE-770 Allocation of Resources Without Limits or Throttling


VersionSourceTypeScoreSeverityVector
3.1ADPCVSS7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1[email protected]Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.10b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Aiohttp Aiohttp All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Aio-libs Aiohttp affected < 3.13.3 Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.4 For RHEL 8 unaffected 0:4.5.30-1.el8ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.4 For RHEL 9 unaffected 0:4.5.30-1.el9ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 For RHEL 8 unaffected 0:4.6.25-1.el8ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 For RHEL 8 unaffected 0:3.13.3-2.el8ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 For RHEL 9 unaffected 0:4.6.25-1.el9ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 For RHEL 9 unaffected 0:3.13.3-2.el9ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 For RHEL 9 unaffected 0:4.7.8-1.el9ap * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 For RHEL 9 unaffected 0:3.13.3-2.el9ap * rpm Not specified
ADP Red Hat Red Hat AI Inference Server 3.2 unaffected 1772160593 * rpm Not specified
ADP Red Hat Red Hat AI Inference Server 3.2 unaffected 1772160625 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.4 unaffected 1768524420 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 unaffected 1768871210 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 unaffected 1774414699 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.5 unaffected 1774446874 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1768890500 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1768846975 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1768853828 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1772499904 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1772508458 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1772473168 * rpm Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2.6 unaffected 1774417022 * rpm Not specified
ADP Red Hat Red Hat Migration Toolkit 1.8 unaffected 1783931722 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1776338381 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1776259063 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770055932 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770103375 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770786633 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770054044 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770621450 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770055428 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770103255 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053703 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053831 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053721 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053740 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053864 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770245096 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770059269 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053785 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770055405 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770055397 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053733 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053728 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053730 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053829 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053864 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053748 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770053723 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1770055425 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 2.25 unaffected 1772093250 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1778264363 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771840993 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771608633 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502869 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502930 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502912 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502889 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502843 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502897 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502844 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498500 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498500 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498575 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498574 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498638 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771498636 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1770956034 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502870 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771511331 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502906 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502921 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502845 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502863 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502906 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502910 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771502884 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1771874181 * rpm Not specified
ADP Red Hat Red Hat OpenShift AI 3.3 unaffected 1782789749 * rpm Not specified
ADP Red Hat OpenShift Lightspeed Not specified Not specified
ADP Red Hat OpenShift Lightspeed Not specified Not specified
ADP Red Hat OpenShift Lightspeed Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat OpenShift Service Mesh 2 Not specified Not specified
ADP Red Hat Red Hat AI Inference Server Not specified Not specified
ADP Red Hat Red Hat AI Inference Server Not specified Not specified
ADP Red Hat Red Hat AI Inference Server Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform Ansible Core 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform Ansible Core 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform Ansible Core 2 Not specified Not specified
ADP Red Hat Red Hat Ansible Automation Platform Ansible Core 2 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux AI RHEL AI 3 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux AI RHEL AI 3 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux AI RHEL AI 3 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux AI RHEL AI 3 Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat OpenShift AI RHOAI Not specified Not specified
ADP Red Hat Red Hat Satellite 6 Not specified Not specified
ADP Red Hat Red Hat Satellite 6 Not specified Not specified

References

ReferenceSourceLinkTags
access.redhat.com/errata/RHSA-2026:1249 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:41928 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:3960 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:3958 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:3462 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:2106 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:1506 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:1596 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:1609 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:3782 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:10184 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a [email protected] github.com Patch
access.redhat.com/errata/RHSA-2026:37275 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:6308 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:1497 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:2695 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:6309 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
bugzilla.redhat.com/show_bug.cgi 0b0ca135-0b70-47e7-9f44-1890c2a1c46c bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:3713 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg [email protected] github.com Patch, Vendor Advisory
access.redhat.com/errata/RHSA-2026:19712 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:1599 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/security/cve/CVE-2025-69223 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c security.access.redhat.com
access.redhat.com/errata/RHSA-2026:3461 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:3959 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Additional Advisory Data

SourceTimeEvent
ADP2026-01-06T20:01:19.831ZReported to Red Hat.
ADP2026-01-05T22:00:17.715ZMade public.

Solutions

ADP: RHSA-2026:1497: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9

ADP: RHSA-2026:1506: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9

ADP: RHSA-2026:3959: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9

ADP: RHSA-2026:1249: Red Hat Ansible Automation Platform 2.6 for RHEL 9

ADP: RHSA-2026:3958: Red Hat Ansible Automation Platform 2.6 for RHEL 9

ADP: RHSA-2026:3461: Red Hat AI Inference Server 3.2

ADP: RHSA-2026:3462: Red Hat AI Inference Server 3.2

ADP: RHSA-2026:1599: Red Hat Ansible Automation Platform 2.4

ADP: RHSA-2026:1609: Red Hat Ansible Automation Platform 2.5

ADP: RHSA-2026:6308: Red Hat Ansible Automation Platform 2.5

ADP: RHSA-2026:1596: Red Hat Ansible Automation Platform 2.6

ADP: RHSA-2026:3960: Red Hat Ansible Automation Platform 2.6

ADP: RHSA-2026:6309: Red Hat Ansible Automation Platform 2.6

ADP: RHSA-2026:41928: Red Hat Migration Toolkit 1.8

ADP: RHSA-2026:3782: Red Hat OpenShift AI 2.25

ADP: RHSA-2026:10184: Red Hat OpenShift AI 2.25

ADP: RHSA-2026:2106: Red Hat OpenShift AI 2.25

ADP: RHSA-2026:2695: Red Hat OpenShift AI 2.25

ADP: RHSA-2026:3713: Red Hat OpenShift AI 3.3

ADP: RHSA-2026:37275: Red Hat OpenShift AI 3.3

ADP: RHSA-2026:19712: Red Hat OpenShift AI 3.3

Workarounds

ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report