CVE-2025-69223 is a denial of service vulnerability in the AIOHTTP Python library's HTTP Parser auto_decompress feature. The flaw allows an attacker to send a specially crafted compressed request (zip bomb) that, when decompressed by the server, can exhaust system memory resources, leading to service disruption. This vulnerability affects AIOHTTP versions 3.13.2 and earlier. Red Hat Ansible Automation Platform versions prior to 3.13.3 include this vulnerable library. Red Hat has issued security updates for Ansible Automation Platform 2.4 and related components to mitigate this issue. The vulnerability is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and related CWEs indicating resource exhaustion and denial of service conditions. No active exploitation has been observed.

Successful exploitation of this vulnerability can cause a denial of service by exhausting memory resources on the host running the AIOHTTP server component of Red Hat Ansible Automation Platform. This results in service unavailability or degradation. There is no impact on confidentiality or integrity reported. The vulnerability is rated as high severity due to its potential to disrupt availability.

Red Hat has released updated packages that fix this vulnerability in Red Hat Ansible Automation Platform 2.4 and related components, including automation-controller version 4.5.30 and receptor version 1.6.3. Users should apply these official updates as documented in the Red Hat advisory. Currently, no alternative mitigations meet Red Hat's criteria for ease of use and applicability. Monitoring for updates and applying patches promptly is recommended. No known mitigations other than patching are available.