Back to Database
Status published
High
CVE-2025-69223
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Vulnerability Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69223
Credits & Attribution
No credits recorded in the NVD database.
References
More from aio-libs
View All →CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
Low
2.7
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Medium
6.6
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
Medium
6.6
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
Medium
6.6
CVE-2025-69226
AIOHTTP allows for a brute-force leak of internal static filepath components
Medium
6.3
Affected Vendor
aio-libs
View all reports →Affected Software
aiohttp
Vulnerable Versions:
< 3.13.3
Timeline
Official Publish:
January 5th, 2026
Last Modified:
July 15th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H