aio-libs/aiohttp · Security
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- GHSA ID
- GHSA-6mq8-rvhq-8wgg
- CVE ID
- CVE-2025-69223
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Summary
A zip bomb can be used to execute a DoS against the aiohttp server.
Impact
An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.
Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
CWEs
- CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
- CWE-770 · Allocation of Resources Without Limits or Throttling