Skip to main content

Improper Handling of Highly Compressed Data (Data Amplification)

CVE-2025-69223

High
7.5/10

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

Advisory Timeline

  • Published