Is CVE-2025-69223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69223 being exploited in the wild.

How severe is CVE-2025-69223?

High severity, with a CVSS score of 7.5, published 5 January 2026.

Which products and versions are affected?

aiohttp (PyPI) ECOSYSTEM:introduced=0,fixed=3.13.3.

Is there a fix for CVE-2025-69223?

Yes. aiohttp (PyPI): upgrade to 3.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-69223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-69223?

Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69223: aio-libs aiohttp denial of service via zip bomb in HTTP parser

CVE-2025-69223 · Severity: high · CVSS 7.5 · Published 2026-01-05

AIOHTTP is a widely used Python library for building web servers and clients. A vulnerability in its request handling allows an attacker to send a specially crafted compressed file, known as a 'zip bomb,' which expands to an enormous size when processed. This can cause the server to run out of memory and crash, leading to a denial-of-service (DoS) that disrupts business operations and application availability.

Technologies: aiohttp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-69223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69223 being exploited in the wild.
How severe is CVE-2025-69223?: High severity, with a CVSS score of 7.5, published 5 January 2026.
Which products and versions are affected?: aiohttp (PyPI) ECOSYSTEM:introduced=0,fixed=3.13.3.
Is there a fix for CVE-2025-69223?: Yes. aiohttp (PyPI): upgrade to 3.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-69223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-69223?: Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.13.3 or later
```
pip install "aiohttp>=3.13.3"
```

Technical details

AIOHTTP's HTTP parser contains a resource exhaustion vulnerability (CWE-409/CWE-770) in its 'auto_decompress' feature. The library fails to enforce strict output limits when decompressing incoming request data, allowing a remote, unauthenticated attacker to submit highly compressed payloads (zip bombs). When the server attempts to decompress these payloads, it consumes excessive RAM, leading to a crash or system instability. The fix, introduced in version 3.13.3, implements a default maximum output size of 32MiB per decompression call.

Affected products

aio-libs aiohttp <= 3.13.2
Red Hat Ansible Automation Platform 2.4, 2.5
Red Hat OpenShift AI 2.25.5

Identifiers

CVE-2025-69223
GHSA-6mq8-rvhq-8wgg
PYSEC-2026-1101

Timeline

2026-01-03: patched: Fix committed to aiohttp repository
2026-01-05: disclosed: Security advisory published by aio-libs
2026-01-05: advisory: CVE-2025-69223 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.