GitHub Advisoryadvisory · PyPI

GHSA-6mq8-rvhq-8wgg AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

HIGH Published 2026-01-05 Modified 2026-01-06 Official page ↗

Aliases: CVE-2025-69223
Ecosystem: PyPI
Packages: aiohttp
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-409, CWE-770
Reviewed: 2026-01-05

Affected packages

• PyPI aiohttp: < 3.13.3 → fixed in 3.13.3

Description

Summary A zip bomb can be used to execute a DoS against the aiohttp server. Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory. ------ Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a

Related

Alias · CVE (1)

CVE-2025-69223 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (2)

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) weakness
CWE-770 Allocation of Resources Without Limits or Throttling weakness

References