Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.5%top 61%

CVE-2025-69223: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in aio-libs aiohttp

0
High
Published: 01/05/2026 (01/05/2026, 22:00:17 UTC)
Source: GCVE Database
Vendor/Project: aio-libs
Product: aiohttp

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

CVSS v3.1

Score 7.5high

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Affected versions
< 3.13.3

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/30/2026, 12:04:55 UTC

Technical Analysis

This advisory covers a container release update for Red Hat Ansible Automation Platform 2.6 that addresses multiple security vulnerabilities, including CVE-2025-69223 and ten additional CVEs. The platform provides an enterprise framework for IT automation at scale. The vulnerabilities collectively have a high severity impact, with CVSS vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and an impact on availability. The update is provided by Red Hat Product Security under advisory RHSA-2026:6404. The advisory includes fixes for various bugs and security issues as detailed in the referenced bugzilla entries. No exploits are currently known in the wild. The vendor advisory instructs users to apply this update after ensuring all previous errata are installed.

Potential Impact

The vulnerabilities addressed in this update have a high severity impact, primarily affecting the availability of the Ansible Automation Platform 2.6 container release. The CVSS vector for CVE-2025-69223 indicates that the vulnerabilities can be exploited remotely without authentication or user interaction, potentially leading to denial of service conditions. There is no indication of confidentiality or integrity impact. No known exploits have been reported in the wild.

Mitigation Recommendations

A container release update is available for Red Hat Ansible Automation Platform 2.6 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Refer to the official Red Hat documentation for upgrade instructions: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade. There are no indications that additional mitigations are required beyond applying the update.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2026:6404
Cve Count
11
Additional Cves
["CVE-2025-69873","CVE-2026-1615","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-28498","CVE-2026-28802","CVE-2026-29074","CVE-2026-30827","CVE-2026-30922"]
Cvss Version
null

Threat ID: 6a160968e29bf47b5062e168

Added to database: 05/26/2026, 20:58:16 UTC

Last enriched: 07/30/2026, 12:04:55 UTC

Last updated: 08/01/2026, 07:17:58 UTC

Views: 129

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses