AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Summary
| CVE | CVE-2025-69223 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-01-05 22:15:53 UTC |
| Updated | 2026-07-21 12:17:13 UTC |
| Description | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.004870000 probability, percentile 0.388080000 (date 2026-07-21)
Problem Types: CWE-409 | CWE-770 | CWE-409 CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) | CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling | CWE-770 Allocation of Resources Without Limits or Throttling
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Aio-libs | Aiohttp | affected < 3.13.3 | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 8 | unaffected 0:4.5.30-1.el8ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.4 For RHEL 9 | unaffected 0:4.5.30-1.el9ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:4.6.25-1.el8ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:3.13.3-2.el8ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:4.6.25-1.el9ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:3.13.3-2.el9ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:4.7.8-1.el9ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:3.13.3-2.el9ap * rpm | Not specified |
| ADP | Red Hat | Red Hat AI Inference Server 3.2 | unaffected 1772160593 * rpm | Not specified |
| ADP | Red Hat | Red Hat AI Inference Server 3.2 | unaffected 1772160625 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.4 | unaffected 1768524420 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 | unaffected 1768871210 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 | unaffected 1774414699 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 | unaffected 1774446874 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1768890500 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1768846975 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1768853828 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1772499904 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1772508458 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1772473168 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1774417022 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit 1.8 | unaffected 1783931722 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1776338381 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1776259063 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770055932 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770103375 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770786633 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770054044 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770621450 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770055428 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770103255 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053703 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053831 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053721 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053740 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053864 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770245096 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770059269 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053785 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770055405 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770055397 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053733 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053728 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053730 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053829 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053864 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053748 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770053723 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1770055425 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 2.25 | unaffected 1772093250 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1778264363 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771840993 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771608633 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502869 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502930 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502912 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502889 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502843 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502897 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502844 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498500 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498500 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498575 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498574 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498638 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771498636 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1770956034 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502870 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771511331 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502906 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502921 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502845 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502863 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502906 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502910 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771502884 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1771874181 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1782789749 * rpm | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat AI Inference Server | Not specified | Not specified |
| ADP | Red Hat | Red Hat AI Inference Server | Not specified | Not specified |
| ADP | Red Hat | Red Hat AI Inference Server | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:1249 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41928 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3960 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3958 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3462 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2106 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1506 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1596 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1609 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3782 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:10184 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a | [email protected] | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:37275 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6308 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1497 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2695 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6309 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3713 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg | [email protected] | github.com | Patch, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:19712 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1599 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2025-69223 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3461 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:3959 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-01-06T20:01:19.831Z | Reported to Red Hat. |
| ADP | 2026-01-05T22:00:17.715Z | Made public. |
Solutions
ADP: RHSA-2026:1497: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9
ADP: RHSA-2026:1506: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
ADP: RHSA-2026:3959: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
ADP: RHSA-2026:1249: Red Hat Ansible Automation Platform 2.6 for RHEL 9
ADP: RHSA-2026:3958: Red Hat Ansible Automation Platform 2.6 for RHEL 9
ADP: RHSA-2026:3461: Red Hat AI Inference Server 3.2
ADP: RHSA-2026:3462: Red Hat AI Inference Server 3.2
ADP: RHSA-2026:1599: Red Hat Ansible Automation Platform 2.4
ADP: RHSA-2026:1609: Red Hat Ansible Automation Platform 2.5
ADP: RHSA-2026:6308: Red Hat Ansible Automation Platform 2.5
ADP: RHSA-2026:1596: Red Hat Ansible Automation Platform 2.6
ADP: RHSA-2026:3960: Red Hat Ansible Automation Platform 2.6
ADP: RHSA-2026:6309: Red Hat Ansible Automation Platform 2.6
ADP: RHSA-2026:41928: Red Hat Migration Toolkit 1.8
ADP: RHSA-2026:3782: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:10184: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:2106: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:2695: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:3713: Red Hat OpenShift AI 3.3
ADP: RHSA-2026:37275: Red Hat OpenShift AI 3.3
ADP: RHSA-2026:19712: Red Hat OpenShift AI 3.3
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.