CVE-2025-69223: aio-libs aiohttp
CVSS: 7.5v3.1HighModified
AliasesGHSA-6mq8-rvhq-8wggPYSEC-2026-1101UBUNTU-CVE-2025-69223DEBIAN-CVE-2025-69223CGA-53x2-8mpj-wxcxCGA-5jv8-hjw2-cxhfCGA-6ghf-x2pp-vm86CGA-7g6f-5hqr-23wcCGA-8mjx-qp2r-x6fcCGA-97mg-47gq-36p6CGA-9gm4-9q66-mp2rCGA-fx5q-xcx9-mj74CGA-h255-9vjp-mqm4CGA-h377-5w7q-8h27CGA-h3xh-7jmr-845vCGA-hpq9-v5mc-rrpjCGA-jhvg-mgg7-rh32CGA-prcv-q3h3-p36qCGA-vcj2-hjh2-6622CGA-wg86-v9g2-rfq7CGA-wh2f-3pqm-97p4CGA-xjqp-rh55-v2wcCGA-3chq-rqfq-qr82CGA-3xcc-87vg-933rCGA-5gvq-x7j4-58h2CGA-7fwc-6752-jvg4CGA-9qcj-37xm-wvcxCGA-fjxj-r45g-crjwCGA-hgf9-wf72-2jchCGA-j62f-g8hc-f85mCGA-j62v-jwc6-f99mCGA-jhqv-fghm-j686CGA-m4vq-9hw7-55q6CGA-mr4c-23pv-v238CGA-prmf-xx2j-phrvCGA-q2x9-f927-h7p2CGA-q66g-9xpj-whppCGA-qvxp-wr2f-cv64CGA-rcf2-57h9-f9j2CGA-x4c4-4j55-5fmvCGA-x4jr-7cwv-2qr9CGA-xgrw-5m37-4qf9CGA-xp62-7q5f-8qgh
Published 05-01-2026Last modified 18-09-2026
Vulnerability summary
CVE-2025-69223 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.58%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 05-01-2026PublishedVulnerability first disclosed.
- 18-09-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.01 pp
From 0.57% on 19-09-2026
19-09-202619-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard22 products
- airflow-2< 2.11.0-r19
- airflow-2-bitnami-compat< 2.11.0-r19
- airflow-2-compat< 2.11.0-r19
- airflow-2-iamguarded-compat< 2.11.0-r19
- airflow-3< 3.1.5-r2 | < 3.2.0-r0
Wolfi9 products
- airflow-3< 3.1.5-r2 | < 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
- checkov< 3.2.499-r0
- dask-kubernetes< 2025.7.0-r4
- kserve-storage-controller< 0.17.0-r2
Aio-libs1 product
- aiohttp< 3.13.3
Aiohttp1 product
- aiohttp< 3.13.3
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.11.16-1+deb13u1 | < 3.13.3-1
PyPI1 product
- aiohttp< 3.13.3
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded) | < 3.11.16-1ubuntu0.1
7 vendors · 36 products
References
38 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wggX Refsource CONFIRMWEBREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138aX Refsource MISCWEBFIXREPORTPatch
Show all 38 references
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE
