CVE-2025-69223: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Summary A zip bomb can be used to execute a DoS against the aiohttp server.
Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.
------
Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Patch 2b920c39002cee0ec5b402581779bbaaf7c9138a
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69223?
CVE-2025-69223 is classified as a denial-of-service vulnerability that can severely affect AIOHTTP servers.
How do I fix CVE-2025-69223?
To fix CVE-2025-69223, you should upgrade AIOHTTP to version 3.13.3 or later.
What versions are affected by CVE-2025-69223?
CVE-2025-69223 affects AIOHTTP versions 3.13.2 and below.
What type of attack does CVE-2025-69223 enable?
CVE-2025-69223 enables attackers to perform denial-of-service attacks using zip bomb payloads.
Can CVE-2025-69223 be exploited without authentication?
Yes, CVE-2025-69223 can be exploited by unauthenticated users who send specially crafted requests.