CVE-2025-69223: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in aio-libs aiohttp
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
AI Analysis
Technical Summary
This advisory covers security updates for Red Hat Ansible Automation Platform 2.5 container images. The platform enables enterprise IT automation management. The update addresses multiple vulnerabilities, including CVE-2025-69223, CVE-2026-1615, CVE-2026-25639, CVE-2026-25990, and CVE-2026-26007. The CVSS vector for CVE-2025-69223 indicates network attack vector, low attack complexity, no privileges or user interaction required, with no confidentiality or integrity impact but high impact on availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The advisory references multiple bug fixes and provides updated container images. No known exploits in the wild are reported. The vendor advisory recommends applying the update after ensuring all previous errata are applied.
Potential Impact
The vulnerabilities addressed have a high severity level due to their potential to cause denial of service (availability impact). There is no reported impact on confidentiality or integrity. Exploitation requires no privileges or user interaction and can be performed remotely over the network. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated container images for Ansible Automation Platform 2.5 that address these vulnerabilities. Users should apply this update following the vendor's upgrade instructions and ensure all previously released errata are applied before updating. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
CVE-2025-69223: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in aio-libs aiohttp
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers security updates for Red Hat Ansible Automation Platform 2.5 container images. The platform enables enterprise IT automation management. The update addresses multiple vulnerabilities, including CVE-2025-69223, CVE-2026-1615, CVE-2026-25639, CVE-2026-25990, and CVE-2026-26007. The CVSS vector for CVE-2025-69223 indicates network attack vector, low attack complexity, no privileges or user interaction required, with no confidentiality or integrity impact but high impact on availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The advisory references multiple bug fixes and provides updated container images. No known exploits in the wild are reported. The vendor advisory recommends applying the update after ensuring all previous errata are applied.
Potential Impact
The vulnerabilities addressed have a high severity level due to their potential to cause denial of service (availability impact). There is no reported impact on confidentiality or integrity. Exploitation requires no privileges or user interaction and can be performed remotely over the network. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated container images for Ansible Automation Platform 2.5 that address these vulnerabilities. Users should apply this update following the vendor's upgrade instructions and ensure all previously released errata are applied before updating. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:6308
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-1615","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007"]
- Cvss Version
- 3.1
Threat ID: 6a160968e29bf47b5062e18a
Added to database: 05/26/2026, 20:58:16 UTC
Last enriched: 07/30/2026, 12:17:33 UTC
Last updated: 08/01/2026, 07:17:58 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.