# CVE-2025-69223

## Summary

- **CVE ID:** CVE-2025-69223
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-409, CWE-770
- **Published:** Jan 5, 2026
- **Last Modified:** Sep 17, 2026

## Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

## Affected Products

- aio-libs — aiohttp (< 3.13.3)

## References

- [CNA](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg)
- [CNA](https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2025-69223)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2427456)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1497)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1506)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3959)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1249)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3958)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3461)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3462)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1599)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1609)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6308)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1596)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3960)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6309)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3782)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10184)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2106)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2695)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3713)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19712)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37275)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59159)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59155)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61628)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.57%
- **EPSS Percentile:** 45.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._