Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.5%top 61%

CVE-2025-69223: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in aio-libs aiohttp

0
High
Published: 01/05/2026 (01/05/2026, 22:00:17 UTC)
Source: GCVE Database
Vendor/Project: aio-libs
Product: aiohttp

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

CVSS v3.1

Score 7.5high

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Affected versions
Red HatRed Hat Ansible Automation PlatformRed Hat Ansible Automation Platform 2.5amd64registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:bc8fc8ba010f7e49b2c9a1b8994d6de05650f8028b2c6dbb0db3e721ed53cdef_amd64< 3.13.3

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/30/2026, 12:17:33 UTC

Technical Analysis

This advisory covers security updates for Red Hat Ansible Automation Platform 2.5 container images. The platform enables enterprise IT automation management. The update addresses multiple vulnerabilities, including CVE-2025-69223, CVE-2026-1615, CVE-2026-25639, CVE-2026-25990, and CVE-2026-26007. The CVSS vector for CVE-2025-69223 indicates network attack vector, low attack complexity, no privileges or user interaction required, with no confidentiality or integrity impact but high impact on availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The advisory references multiple bug fixes and provides updated container images. No known exploits in the wild are reported. The vendor advisory recommends applying the update after ensuring all previous errata are applied.

Potential Impact

The vulnerabilities addressed have a high severity level due to their potential to cause denial of service (availability impact). There is no reported impact on confidentiality or integrity. Exploitation requires no privileges or user interaction and can be performed remotely over the network. No known active exploitation has been reported.

Mitigation Recommendations

Red Hat has released updated container images for Ansible Automation Platform 2.5 that address these vulnerabilities. Users should apply this update following the vendor's upgrade instructions and ensure all previously released errata are applied before updating. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2026:6308
Cve Count
5
Additional Cves
["CVE-2026-1615","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007"]
Cvss Version
3.1

Threat ID: 6a160968e29bf47b5062e18a

Added to database: 05/26/2026, 20:58:16 UTC

Last enriched: 07/30/2026, 12:17:33 UTC

Last updated: 08/01/2026, 07:17:58 UTC

Views: 70

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses