7.5
High
CVE-2025-69223 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| aiohttp 3.13 | earliest → < 3.13.3 | 3.13.3 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat AI Inference Server 3.2 1787772157 | earliest → < 1787772157 | 1787772157 |
| Red Hat Ansible Automation Platform 2.4 1768524420 | earliest → < 1768524420 | 1768524420 |
| Red Hat Ansible Automation Platform 2.5 1774414699 | earliest → < 1774414699 | 1774414699 |
Show the 15 other branches Hide the 15 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.6 1774417022 | earliest → < 1774417022 | 1774417022 |
| Red Hat OpenShift AI 2.25 1772093250 | earliest → < 1772093250 | 1772093250 |
| Red Hat OpenShift AI 3.3 1782789749 | earliest → < 1782789749 | 1782789749 |
| Migration Toolkit for Containers | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform Ansible Core 2 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| Red Hat Migration Toolkit 1.8 1783931722 | earliest → < 1783931722 | 1783931722 |
| Red Hat Migration Toolkit for Containers 1.8 1783931722 | earliest → < 1783931722 | 1783931722 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of aiohttp
The 53 CVEs of aiohttp →
CVE-2026-111750
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
6.3
Medium
CVE-2026-111749
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
2.3
Low
CVE-2026-111748
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
6.3
Medium
CVE-2026-111066
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
8.2
High