CVE-2025-69223 is a decompression-based denial of service vulnerability in the AIOHTTP Python library, specifically affecting versions 3.13.2 and earlier. The flaw allows an attacker to send a specially crafted compressed request (zip bomb) that, when decompressed by the AIOHTTP server, can exhaust system memory resources, causing a denial of service. This vulnerability is tracked under multiple CWEs including CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat Ansible Automation Platform 2.5 containers using affected AIOHTTP versions are vulnerable. Red Hat has issued a security advisory (RHSA-2026:6308) providing updated container images and patches to remediate this issue. No known exploits in the wild have been reported. Mitigation options other than patching are either unavailable or insufficient according to Red Hat.

Successful exploitation of this vulnerability can cause denial of service by exhausting memory resources on the host running the affected AIOHTTP server component within Red Hat Ansible Automation Platform 2.5. This can disrupt automation workflows and potentially impact availability of IT automation services. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed.

Red Hat has released updated versions of the Ansible Automation Platform 2.5 container images that address this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2026:6308 and ensure all prior relevant errata are applied. Currently, no effective mitigations other than applying the official update meet Red Hat's criteria for deployment and stability. Users should follow Red Hat's documented upgrade procedures to remediate this issue.