Bug 2427456 (CVE-2025-69223)

Summary: CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: alinfoot, anpicker, anthomas, bbrownin, bdettelb, bparees, carogers, caswilli, dfreiber, doconnor, drow, dtrifiro, dymurray, ehelms, erezende, ggainey, haoli, hasun, hkataria, ibolton, jajackso, jburrell, jcammara, jdobes, jfula, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jowilson, jsamir, juwatts, jwong, kaycoth, kegrant, koliveir, kshier, lphiri, mabashia, mhulan, nmoumoul, nyancey, omaciel, ometelka, orabin, osousa, pakotvan, pbraun, pcreech, pgaikwad, ptisnovs, rbryant, rchan, rjohnson, shvarugh, simaishi, slucidi, smallamp, smcdonal, sseago, stcannon, sthirugn, syedriko, teagle, tfister, thavo, tmalecek, ttakamiy, vkumar, weaton, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A decompression based denial of service flaw has been discovered in the AIOHTTP python library. Library versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-06 20:02:24 UTC
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Comment 2 errata-xmlrpc 2026-01-26 19:36:15 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:1249 https://access.redhat.com/errata/RHSA-2026:1249

Comment 3 errata-xmlrpc 2026-01-28 15:23:51 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 8
  Red Hat Ansible Automation Platform 2.4 for RHEL 9

Via RHSA-2026:1497 https://access.redhat.com/errata/RHSA-2026:1497

Comment 4 errata-xmlrpc 2026-01-28 17:23:12 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:1506 https://access.redhat.com/errata/RHSA-2026:1506

Comment 5 errata-xmlrpc 2026-03-06 10:12:21 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958

Comment 6 errata-xmlrpc 2026-03-06 10:55:17 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2026:3959 https://access.redhat.com/errata/RHSA-2026:3959