Skip to content
Heist/ feed
Back to feed
High

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Type: advisorySources: OSV

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-69223
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 08:25 UTC · Revision 1

Source evidence

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

core-osv · Original source

Published 5 Jan 2026, 22:00 UTC

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

osv:CVE-2025-69223
Complete source record
{
  "id": "714d20cd7c77d13f1a284381f30e04db808076cfaecc76474b1edd8adaa4119f",
  "url": "https://osv.dev/vulnerability/CVE-2025-69223",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb",
    "summary": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.",
    "evidence": "osv:CVE-2025-69223",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-69223",
      "aliases": [
        "CVE-2025-69223",
        "GHSA-6mq8-rvhq-8wgg",
        "PYSEC-2026-1101"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/aio-libs/aiohttp",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "41f01ed680b7efc8f97677df45731b80328aad6c"
                },
                {
                  "fixed": "2b920c39002cee0ec5b402581779bbaaf7c9138a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.13.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "2b920c39002cee0ec5b402581779bbaaf7c9138a"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.13.2",
            "v3.13.1",
            "v3.13.0",
            "v3.12.0",
            "v3.12.0rc1",
            "v3.12.0rc0",
            "v3.12.0b3",
            "v3.12.0b2",
            "v3.12.0b1",
            "v3.12.0b0",
            "v3.11.0",
            "v3.11.0rc2",
            "v3.11.0rc1",
            "v3.11.0rc0",
            "v3.11.0b5",
            "v3.11.0b4",
            "v3.11.0b3",
            "v3.11.0b2",
            "v3.11.0b1",
            "v3.11.0b0",
            "v3.10.0",
            "v3.10.0rc0",
            "v3.10.0b1",
            "v3.10.0b0",
            "v3.9.0",
            "v3.9.0rc0",
            "v3.9.0b1",
            "v3.9.0b0",
            "v3.8.0",
            "v3.7.1",
            "v3.7.0",
            "v3.7.0b1",
            "v3.7.0b0",
            "v3.6.2",
            "v3.6.2a2",
            "v3.6.2a1",
            "v3.6.1",
            "v3.6.1b4",
            "v3.6.1b3",
            "v3.6.0",
            "v3.6.0b0",
            "v3.6.0a12",
            "v3.6.0a11",
            "v3.6.0a10",
            "v3.6.0a9",
            "v3.6.0a8",
            "v3.6.0a7",
            "v3.6.0a6",
            "v3.6.0a5",
            "v3.6.0a4",
            "v3.6.0a3",
            "v3.6.0a2",
            "v3.6.0a1",
            "v3.6.0a0",
            "v3.5.4",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.5.0",
            "v3.5.0b3",
            "v3.5.0b2",
            "v3.5.0b1",
            "v3.5.0a1",
            "v3.4.0",
            "v3.4.0b2",
            "v3.4.0b1",
            "v3.4.0a3",
            "v3.4.0a0",
            "v3.2.0",
            "v3.1.0",
            "v3.0.0b4",
            "v3.0.0b3",
            "v3.0.0b2",
            "v3.0.0b1",
            "v3.0.0b0",
            "v2.3.0",
            "v2.3.0a4",
            "v2.3.0a3",
            "v2.3.0a2",
            "v2.3.0a1",
            "v2.2.0",
            "v2.1.0",
            "2.0.0",
            "2.0.0rc1",
            "1.3.0",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.1",
            "v1.0.0",
            "v0.22.1",
            "v0.22.0",
            "v0.22.0b6",
            "v0.22.0b5",
            "v0.22.0b4",
            "v0.22.0b3",
            "v0.22.0b2",
            "v0.22.0b1",
            "v0.22.0b0",
            "4v0.21.6",
            "v0.21.0",
            "v0.20.1",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.3",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0",
            "v0.15.3",
            "0.15.2",
            "v0.15.2",
            "v0.15.1",
            "v0.15.0",
            "v0.14.4",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.0",
            "v0.10.1",
            "v0.10.0",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.3",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v.0.6.5",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.5.0",
            "v0.4.2",
            "v0.4.1",
            "v0.4",
            "v0.3",
            "v0.2",
            "v0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69223.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.294956212Z",
      "provider": "osv",
      "references": [
        "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json",
        "https://access.redhat.com/errata/RHSA-2026:10184",
        "https://access.redhat.com/errata/RHSA-2026:1249",
        "https://access.redhat.com/errata/RHSA-2026:1497",
        "https://access.redhat.com/errata/RHSA-2026:1506",
        "https://access.redhat.com/errata/RHSA-2026:1596",
        "https://access.redhat.com/errata/RHSA-2026:1599",
        "https://access.redhat.com/errata/RHSA-2026:1609",
        "https://access.redhat.com/errata/RHSA-2026:19712",
        "https://access.redhat.com/errata/RHSA-2026:2106",
        "https://access.redhat.com/errata/RHSA-2026:2695",
        "https://access.redhat.com/errata/RHSA-2026:3461",
        "https://access.redhat.com/errata/RHSA-2026:3462",
        "https://access.redhat.com/errata/RHSA-2026:3713",
        "https://access.redhat.com/errata/RHSA-2026:37275",
        "https://access.redhat.com/errata/RHSA-2026:3782",
        "https://access.redhat.com/errata/RHSA-2026:3958",
        "https://access.redhat.com/errata/RHSA-2026:3959",
        "https://access.redhat.com/errata/RHSA-2026:3960",
        "https://access.redhat.com/errata/RHSA-2026:41928",
        "https://access.redhat.com/errata/RHSA-2026:59155",
        "https://access.redhat.com/errata/RHSA-2026:59159",
        "https://access.redhat.com/errata/RHSA-2026:61628",
        "https://access.redhat.com/errata/RHSA-2026:6308",
        "https://access.redhat.com/errata/RHSA-2026:6309",
        "https://access.redhat.com/security/cve/CVE-2025-69223",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69223.json",
        "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-69223",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2427456",
        "https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-409",
          "CWE-770"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69223.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-69223",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518748,
  "published_at": "2026-01-05T22:00:17.715+00:00"
}