CVE-2025-69223
7.5
Puff, The Magic Dragon: Exploding RAM with aiohttp Zip Bombs
Amit Schendel
Senior Security ResearcherJan 6, 2026·6 min read·16 visits
PoC Available
Executive Summary (TL;DR)
aiohttp versions <= 3.13.2 failed to cap the output size of decompressed request bodies. By sending a small, highly compressed payload (gzip, deflate, brotli), an attacker can force the server to allocate gigabytes of memory, triggering an OOM crash and Denial of Service.
A classic 'Zip Bomb' vulnerability in the popular Python aiohttp framework allowing unauthenticated attackers to exhaust server memory via highly compressed payloads.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAffected Systems
aiohttp <= 3.13.2
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
aiohttp aio-libs | <= 3.13.2 | 3.13.3 |
| Attribute | Detail |
|---|---|
| CWE | CWE-409 (Improper Handling of Highly Compressed Data) |
| CVSS | 7.5 (High) |
| Attack Vector | Network |
| Exploit Status | PoC Available |
| Impact | Denial of Service (DoS) |
| Patch | v3.13.3 |
MITRE ATT&CK Mapping
CWE-409
Improper Handling of Highly Compressed Data
The software does not handle compressed data correctly, allowing an attacker to cause a denial of service by sending a small amount of data that decompresses to a very large amount.
Known Exploits & Detection
Vulnerability Timeline
Fix committed to master branch
2026-01-03
CVE-2025-69223 Published
2026-01-05
aiohttp v3.13.3 Released
2026-01-05