CVE-2025-69223: AIOHTTP Zip Bomb Vulnerability Leading to DoS Attacks
Summary
CVE-2025-69223: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Also tracked for
The same CVE-2025-69223 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular Python library used for building asynchronous web applications. It provides an easy-to-use interface for handling HTTP requests and responses, making it a go-to choice for developers looking to create efficient web servers and clients. However, the library's auto_decompress feature has a critical vulnerability that can be exploited through specially crafted compressed requests.
Vulnerability Detail
The vulnerability arises from AIOHTTP's HTTP Parser auto_decompress feature, which is susceptible to zip bomb attacks. A zip bomb is a maliciously crafted compressed file that, when decompressed, expands to an enormous size, potentially exhausting the host's memory. An attacker can exploit this vulnerability by sending a compressed request that, when processed by AIOHTTP, could lead to a denial of service (DoS) by consuming all available memory resources.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the auto_decompress feature in your AIOHTTP server configuration. This can be done by setting the 'decompress' parameter to False when handling requests. For example: 'await request.json(decompress=False)'. However, this may affect the handling of legitimate compressed requests.
Conclusion
The CVE-2025-69223 vulnerability in AIOHTTP poses a significant risk of DoS attacks through zip bomb exploitation. It is crucial for developers using this library to update to the latest version or implement workarounds to protect their applications from potential memory exhaustion attacks.
See every vulnerability recorded for aiohttp →
FAQ
A zip bomb is a maliciously crafted compressed file that expands to a massive size when decompressed, potentially overwhelming system resources.
If your application uses AIOHTTP and processes compressed requests, it may be vulnerable to DoS attacks, leading to service outages.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider implementing the workaround by disabling the auto_decompress feature to mitigate the risk temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
