The aiohttp library versions up to 3.13.2 contain a flaw in handling highly compressed data due to improper resource allocation limits during decompression. This vulnerability (CWE-409, CWE-770) allows an attacker to send a zip bomb that, when decompressed by aiohttp's HTTP parser auto_decompress feature, can consume excessive memory and cause a denial of service. The vulnerability is addressed in version 3.13.3. Red Hat's advisory confirms the impact and notes that no effective mitigation other than upgrading meets their criteria. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high availability impact.

Successful exploitation results in a denial of service condition by exhausting memory resources on the host running aiohttp server versions 3.13.2 and below. This disrupts availability but does not impact confidentiality or integrity. No known exploits are reported in the wild at this time.

An official fix is available in aiohttp version 3.13.3. Users should upgrade to this version or later to remediate the vulnerability. Red Hat notes that no alternative mitigations meet their criteria for ease of use and stability, so upgrading is the recommended and effective solution.