CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

What is CVE-2025-69223?

CVE-2025-69223 is a high-severity denial of service vulnerability in aio-libs aiohttp, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Weakness: CWE-770, CWE-409

Which versions are affected by CVE-2025-69223?

3 open source packages ship an affected version, including aiohttp. It affects 1 product.

Products include Aiohttp Aiohttp.

How do I fix CVE-2025-69223?

Upgrade aiohttp to 3.13.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-69223 being exploited?

There is no known exploitation of CVE-2025-69223 in the wild and no public exploit code.

Other vulnerabilities in aio-libs aiohttp

• CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method High 8.7
• CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp High 7.5
• CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version High 7.2
• CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers Medium 6.9
• CVE-2026-54273 AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-73494, AZL-73517, CLEANSTART-2026-OU64383, CLEANSTART-2026-WQ53344, CLSA-2026-1790250538, CLSA-2026-1790342075 and 11 more.