CVE-2025-69223
📋 TL;DR
AIOHTTP versions 3.13.2 and below are vulnerable to a zip bomb denial-of-service attack. An attacker can send specially crafted compressed requests that cause excessive memory consumption when decompressed, potentially crashing the server. This affects any Python application using vulnerable AIOHTTP versions as an HTTP server.
💻 Affected Systems
- aiohttp
📦 What is this software?
Aiohttp by Aiohttp
⚠️ Risk & Real-World Impact
Worst Case
Complete server outage due to memory exhaustion, causing service disruption and potential data loss in active sessions.
Likely Case
Temporary service degradation or server crashes requiring manual restart, impacting availability.
If Mitigated
Minimal impact with proper request size limits and monitoring in place.
🎯 Exploit Status
Exploitation requires sending HTTP requests with compressed payloads. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.13.3
Vendor Advisory: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg
Restart Required: Yes
Instructions:
1. Update aiohttp: pip install --upgrade aiohttp==3.13.3
2. Restart all services using aiohttp
3. Verify the new version is active
🔧 Temporary Workarounds
Limit request body size
allConfigure AIOHTTP to reject large compressed requests before decompression
client_max_size = 1024 * 1024 # 1MB limit in your aiohttp app configuration
Disable request compression
allPrevent AIOHTTP from accepting compressed request bodies
app = web.Application(client_max_size=0)
🧯 If You Can't Patch
- Implement reverse proxy with request size limits (e.g., nginx client_max_body_size)
- Deploy rate limiting and WAF rules to block suspicious compressed requests
🔍 How to Verify
Check if Vulnerable:
Check aiohttp version: python -c "import aiohttp; print(aiohttp.__version__)"Check Version:
python -c "import aiohttp; print(aiohttp.__version__)"Verify Fix Applied:
Confirm version is 3.13.3 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Sudden memory spikes
- Server crashes with memory errors
- Unusually large request sizes in access logs
Network Indicators:
- HTTP requests with Content-Encoding: gzip/deflate and large compressed payloads
- Rapid consecutive compressed requests from single source
SIEM Query:
source="aiohttp" AND ("MemoryError" OR "out of memory" OR "Killed")