PT-2026-1348 · Aiohttp+4 · Aiohttp+4

Published 2026-01-05 · Updated 2026-04-20 · CVE-2025-69223

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below

Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, is susceptible to a denial-of-service (DoS) attack. An attacker can send a compressed request, specifically a zip bomb, that when decompressed by AIOHTTP, exhausts the host's memory. This could lead to service disruption.

Recommendations Update AIOHTTP to version 3.13.3 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-409

Related Identifiers

AZL-73494

AZL-73517

BDU:2026-07337

CVE-2025-69223

ECHO-CEBA-EB70-4DA5

GHSA-6MQ8-RVHQ-8WGG

OPENSUSE-SU-2026:10025-1

OPENSUSE-SU-2026:20204-1

RHSA-2026:1249

RHSA-2026:1497

RHSA-2026:1506

RHSA-2026:3958

RHSA-2026:3959

SUSE-SU-2026:0858-1

SUSE-SU-2026:0859-1

SUSE-SU-2026:20425-1

USN-8032-1

Affected Products

Aiohttp

Debian

Linuxmint

Red Os

Ubuntu

References · 57

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69223.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-69223 · Security Note
• https://ubuntu.com/security/CVE-2025-69229 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69223 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20204-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mq8-rvhq-8wgg · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07337 · Security Note
• https://osv.dev/vulnerability/AZL-73517 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10025-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69225 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69227 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69223 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69223 · Vendor Advisory