DoS via Zip Bomb in AIOHTTP 3.13.2 (fixed 3.13.3)
CVE-2025-69223 Published on January 5, 2026

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Github Repository NVD

Vulnerability Analysis

CVE-2025-69223 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2025-69223 has been classified to as a Data Amplification vulnerability or weakness.

Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.


Products Associated with CVE-2025-69223

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-69223 are published in these products:

Canonical Ubuntu Linux
 
Oracle
 
Red Hat Ansible Automation Platform
 
Red Hat Ansible Automation Platform Developer
 
Red Hat Ansible Automation Platform Inside
 
Red Hat Ai Inference Server
 
Red Hat Openshift Ai
 
Red Hat Rhmt
 
Red Hat Openshift Lightspeed
 
Red Hat Ansible Core
 
Red Hat Enterprise Linux Ai
 
Red Hat Satellite
 
Red Hat Service Mesh
 

Affected Versions

aio-libs aiohttp: Red Hat Ansible Automation Platform 2.4 for RHEL 8: Red Hat Ansible Automation Platform 2.4 for RHEL 9: Red Hat Ansible Automation Platform 2.5 for RHEL 8: Red Hat Ansible Automation Platform 2.5 for RHEL 8: Red Hat Ansible Automation Platform 2.5 for RHEL 9: Red Hat Ansible Automation Platform 2.5 for RHEL 9: Red Hat Ansible Automation Platform 2.6 for RHEL 9: Red Hat Ansible Automation Platform 2.6 for RHEL 9: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.2: Red Hat Ansible Automation Platform 2.4: Red Hat Ansible Automation Platform 2.5: Red Hat Ansible Automation Platform 2.5: Red Hat Ansible Automation Platform 2.5: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat Ansible Automation Platform 2.6: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat OpenShift AI 3.3: Red Hat Migration Toolkit for Containers: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat Satellite 6: Red Hat Satellite 6:

Vulnerable Packages

The following package name and versions may be associated with CVE-2025-69223

Package Manager Vulnerable Package Versions Fixed In
pip aiohttp <= 3.13.2 3.13.3

Exploit Probability

EPSS
0.30%
Percentile
21.35%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.