Junglewise Threat Intelligence

CVE-2025-69223: aio-libs aiohttp denial of service via zip bomb in HTTP parser

CVE-2025-69223 · Severity: high · CVSS 7.5 · Published 2026-01-05

Technologies: Aio-Libs Aiohttp, Red Hat Ansible Automation Platform. Vendors: Red Hat, PyPI.

Executive brief

AIOHTTP is a widely used Python library for building web servers and clients. A vulnerability in its request handling allows an attacker to send a specially crafted compressed file, known as a 'zip bomb,' which expands to an enormous size when processed. This can cause the server to run out of memory and crash, leading to a denial-of-service (DoS) that disrupts business operations and application availability.

Technical details

AIOHTTP's HTTP parser contains a resource exhaustion vulnerability (CWE-409/CWE-770) in its 'auto_decompress' feature. The library fails to enforce strict output limits when decompressing incoming request data, allowing a remote, unauthenticated attacker to submit highly compressed payloads (zip bombs). When the server attempts to decompress these payloads, it consumes excessive RAM, leading to a crash or system instability. The fix, introduced in version 3.13.3, implements a default maximum output size of 32MiB per decompression call.

Affected products

  • aio-libs aiohttp <= 3.13.2
  • Red Hat Ansible Automation Platform 2.4, 2.5
  • Red Hat OpenShift AI 2.25.5

Timeline

  • 2026-01-03: patched: Fix committed to aiohttp repository
  • 2026-01-05: disclosed: Security advisory published by aio-libs
  • 2026-01-05: advisory: CVE-2025-69223 published

References

Related threats