CVE-2025-69223

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Configurations

Configuration 1 (hide)

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

History

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:37275 -

30 Jun 2026, 03:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:10184 -
  • () https://access.redhat.com/errata/RHSA-2026:1249 -
  • () https://access.redhat.com/errata/RHSA-2026:1497 -
  • () https://access.redhat.com/errata/RHSA-2026:1506 -
  • () https://access.redhat.com/errata/RHSA-2026:1596 -
  • () https://access.redhat.com/errata/RHSA-2026:1599 -
  • () https://access.redhat.com/errata/RHSA-2026:1609 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:2106 -
  • () https://access.redhat.com/errata/RHSA-2026:2695 -
  • () https://access.redhat.com/errata/RHSA-2026:3461 -
  • () https://access.redhat.com/errata/RHSA-2026:3462 -
  • () https://access.redhat.com/errata/RHSA-2026:3713 -
  • () https://access.redhat.com/errata/RHSA-2026:3782 -
  • () https://access.redhat.com/errata/RHSA-2026:3958 -
  • () https://access.redhat.com/errata/RHSA-2026:3959 -
  • () https://access.redhat.com/errata/RHSA-2026:3960 -
  • () https://access.redhat.com/errata/RHSA-2026:6308 -
  • () https://access.redhat.com/errata/RHSA-2026:6309 -
  • () https://access.redhat.com/security/cve/CVE-2025-69223 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2427456 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json -

17 Jun 2026, 10:00

Type Values Removed Values Added
References () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg - Vendor Advisory, Patch () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg - Patch, Vendor Advisory

14 Jan 2026, 19:11

Type Values Removed Values Added
References () https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a - () https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a - Patch
References () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg - () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg - Vendor Advisory, Patch
CPE cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
First Time Aiohttp aiohttp
Aiohttp

05 Jan 2026, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-05 22:15

Updated : 2026-07-15 02:17


NVD link : CVE-2025-69223

Mitre link : CVE-2025-69223

CVE.ORG link : CVE-2025-69223


JSON object : View

Products Affected

aiohttp

  • aiohttp
CWE
CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

CWE-770

Allocation of Resources Without Limits or Throttling