AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

ALTO 7.5CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg · PYSEC-2026-1101 · Published 05/01/2026 · updated 11/10/2026

En resumen

CVE-2025-69223 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a aiohttp, aiohttp (aiohttp).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.58%, mayor que el 47.9% de las vulnerabilidades.
Solución: actualizar a 3.13.3 o posterior.

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.13.3`	`3.13.3`
aiohttp aiohttp	`< 3.13.3`	`3.13.3`

Description

Summary

A zip bomb can be used to execute a DoS against the aiohttp server.

Impact

An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

References

Más vulnerabilidades de aiohttp

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

aiohttp

PyPI

< 3.13.3

3.13.3

aiohttp

< 3.13.3

3.13.3

Description

Summary

A zip bomb can be used to execute a DoS against the aiohttp server.

Impact

An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

NVD description

Más vulnerabilidades de aiohttp

Ver todo →