CVE-2025-69223
Published: 05 January 2026
Summary
CVE-2025-69223 is a high-severity Data Amplification (CWE-409) vulnerability in Aiohttp Aiohttp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-69223 is a denial-of-service vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below are affected, as they improperly handle highly compressed data in requests, enabling a zip bomb attack. An attacker can send a maliciously crafted compressed request that, upon decompression by the AIOHTTP server, exhausts the host's memory resources. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-409 (Improper Handling of Highly Compressed Data) and CWE-770 (Allocation of Resources Without Limits or Throttling).
The attack requires no authentication or user interaction and can be launched remotely over the network with low complexity. Any unauthenticated attacker able to reach an affected AIOHTTP server can exploit it by transmitting a specially crafted zip bomb in a compressed HTTP request, resulting in memory exhaustion and potential server crashes or unresponsiveness.
The vulnerability is addressed in AIOHTTP version 3.13.3. Security practitioners should upgrade to this version for mitigation. Additional details are available in the GitHub security advisory (GHSA-6mq8-rvhq-8wgg) and the fixing commit (2b920c39002cee0ec5b402581779bbaaf7c9138a).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206229
Vulnerability details
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request…
more
that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing AIOHTTP web framework directly enables remote exploitation for application-layer DoS via crafted compressed input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by identifying, reporting, and correcting the flaw in AIOHTTP's handling of highly compressed zip bomb data through patching to version 3.13.3.
Provides denial-of-service protections specifically designed to counter resource exhaustion attacks like the memory-depleting zip bomb in compressed HTTP requests.
Enforces resource allocation limits to prevent memory exhaustion from decompression of maliciously crafted compressed requests.