Executive brief
AIOHTTP is a widely used Python library for building web servers and clients. A vulnerability in its request handling allows an attacker to send a specially crafted compressed file, known as a 'zip bomb,' which expands to an enormous size when processed. This can cause the server to run out of memory and crash, leading to a denial-of-service (DoS) that disrupts business operations and application availability.
Technical details
AIOHTTP's HTTP parser contains a resource exhaustion vulnerability (CWE-409/CWE-770) in its 'auto_decompress' feature. The library fails to enforce strict output limits when decompressing incoming request data, allowing a remote, unauthenticated attacker to submit highly compressed payloads (zip bombs). When the server attempts to decompress these payloads, it consumes excessive RAM, leading to a crash or system instability. The fix, introduced in version 3.13.3, implements a default maximum output size of 32MiB per decompression call.
Affected products
- aio-libs aiohttp <= 3.13.2
- Red Hat Ansible Automation Platform 2.4, 2.5
- Red Hat OpenShift AI 2.25.5
Timeline
- 2026-01-03: patched: Fix committed to aiohttp repository
- 2026-01-05: disclosed: Security advisory published by aio-libs
- 2026-01-05: advisory: CVE-2025-69223 published
References
- https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:1249
- https://access.redhat.com/errata/RHSA-2026:1497
- https://access.redhat.com/errata/RHSA-2026:1506
- https://access.redhat.com/errata/RHSA-2026:1596