AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the hosts memory. This issue is fixed in version 3.13.3.
Weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aiohttp | Aiohttp | * | 3.13.3 (excluding) |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | RedHat | automation-controller-0:4.5.30-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | RedHat | automation-controller-0:4.5.30-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | automation-controller-0:4.6.25-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | python3.12-aiohttp-0:3.13.3-2.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | automation-controller-0:4.6.25-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | python3.12-aiohttp-0:3.13.3-2.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | automation-controller-0:4.7.8-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-aiohttp-0:3.13.3-2.el9ap | * |
| Red Hat AI Inference Server 3.2 | RedHat | rhaiis/vllm-cuda-rhel9:sha256:dcb9d1cd005c40b6db6f893e56419e383b9dcc0d38315605cb1457e2af5354f7 | * |
| Red Hat AI Inference Server 3.2 | RedHat | rhaiis/vllm-rocm-rhel9:sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a | * |
| Red Hat Ansible Automation Platform 2.4 | RedHat | ansible-automation-platform-24/controller-rhel8:sha256:37957b7b5eee1bc4a128974f3bfc0e6d31f49c457b50140b361b981626d8c0af | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/controller-rhel8:sha256:e627268fea858240171a3330fdaee5c952500b33e04584e31848c615b3e1826f | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/controller-rhel9:sha256:bb334abcc74bbebff0442393d370d7a4990097b275cf46761933a7fd61d94c87 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/de-minimal-rhel9:sha256:c4cf08cdbba3e616e2453f124ce11ebb72653e0de6a780b4f68307c90cda342d | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/de-supported-rhel9:sha256:1dd6b6b9d9426175830de6066033115287ec259d118d5214582730209f3b3e63 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-minimal-rhel9:sha256:e03ecf5a07697a55c2c8268e8b338aae633efe20d7339dd799142d557c33ebd2 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-supported-rhel9:sha256:7f14fcbf8d51f06c5e4c7cbbc4d7cab2a3b2c01f5b12f58b5b6eb58668dd77f1 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/hub-rhel9:sha256:efa281dab00fcd21c3e35e5804c8f96bf574058efb6308e070db2fc900f4eee8 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:sha256:509b53d9ccd21683c81b4e42770dc0d90e9c05de5f20df7edf1fa0c7591b8ae2 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ml-pipelines-runtime-generic-rhel9:sha256:e15c9c336a37dc83afbb1b0a69a9b5dd50ac515f0cde2560a4d00ed6bba7d244 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-openvino-model-server-rhel9:sha256:fbfd2e7078a290dc240310e34bdf65eaf4b4fec5f6d5440e400b5481960ef448 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:sha256:d17199ec02f3f62ed061a5d51d8a9f7497dcade091a7b3c01ad14a781f6e97df | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:sha256:9414a3f5c38ef2fe7ed73f70bb2cf7c3f271ea75c941bce2561e74b81251c153 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:sha256:0780f52efa6c68ea2fb6371edfbd8b703157c38911803985bb1a676c84e073b5 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:sha256:a202c9ec6be34c4be1793e4f9f348077f345c450e0fcd04071d5092f266df9b4 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:sha256:e18d2d006c8cd4e3d3816540e154f421e7550a96f73901a799c15a5b4fe576db | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:sha256:6e8f2fc28114e00d6f46450f111916b5b4efbdc1cee78596d36cd24baaea0c1c | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:sha256:3bdeae6f78230e1d966cf7a3f35ea821c808f40cc4c2abb7af9b1748f5611826 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ta-lmes-job-rhel9:sha256:8dd600e003d1b6395f1406fc31c17f7204ec6cce0e067dac8c2f3cbed4534c49 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-cuda-rhel9:sha256:78ccc2cef82e18943e3d9f3433597a77c3430814ab9f042c5b2a9e907049f8de | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-rocm-rhel9:sha256:7cf5a595faf09636baa94db52be028d4d4d1e2be0fc4748d276719387b2de3b4 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:sha256:b15df9b9947b193cf648102945059587d5f56353b3a2f97e148ec30c34ec3953 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:sha256:300d59e66dee9bfc24d53cc14428c1fd95ea714e34a1b75b1317bd5a7f182150 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:sha256:0a10e0df52a41f7ca9053f3292befde92ab9e1c2965bc3a2bdbe51eaeb5b8e48 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:sha256:158c783d59cdbdb9028c4dd760632edd7295330b5dcebbe0017bff4089635c3a | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:sha256:fbe346eafcfbb867f595cbad5ea0190fabbabc61ad80a4be2265e0e2b0149f68 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:sha256:fec8bf2d539fd00df8854a723bae98b7e173c43153c3132ba459bc0e9a86ae35 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:sha256:b19482e4008ac03a39b432fb3056bb1ab372ef1617df5bbfe784bc2910b6827a | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:sha256:1213d9e9a56ec3fddb887082d95c2ac168876eee8592aba265aeadd7ffad3898 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:sha256:85abac79e8d09b61a9fffb0b5d3fd2a3f9da65bad9573a72cecb878a81357dcf | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:sha256:dc4a277cebbdc373534b73a432085d3a4b502e3c189fe75da8f0441ff9d3ce2c | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ml-pipelines-runtime-generic-rhel9:sha256:6490c1848b373efe6c327f8959e06b66b1ac3fe0f90fa697f7309d9f48c66765 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-openvino-model-server-rhel9:sha256:84739168d6ea2813c5b9666773166649a6b328a279dac80b61c51311a6a2943a | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-caikit-tgis-serving-rhel9:sha256:f90e965a1638402b4dec6bb022cbb1d1e992c8fd71d0b687f8562a9abf478dc4 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:sha256:b67292b8828b41361925def921ba2713b4d7eaa83b2088e0ad21e44ba52eb228 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-openvino-model-server-rhel9:sha256:8c7183a236dc4572833eb5dc99d6d08919a0eece1d1f346a5a7195c7cc30fcd7 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:sha256:d8156790f262ad6081b9030afb6516f26079ae11612f6c2e78bc518ea92f10d3 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:sha256:c484b151d74628f96c0dc6ea3710da759bf123b110ac0518e29536a66d961b47 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:sha256:b275a657a249223727b565df671c6c0db6e988b267cdb3ba0619c6334718747b | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:sha256:12128f22697ec726d3cfa2b3eee1175976a87c4fab3aa6dcd89d9abe67093d0c | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:sha256:7a884421baef638e002bc0fcecfd46ea42dec4001c558bb1185b8b8363b0adb2 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:sha256:fe82beac213677f49829417625b86292ae9de39b4b888a88efac56ff212fbe99 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:sha256:5cb6f52106f21514649baea4646169c183d6b754397e3611c956aa174f3e5535 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda121-torch24-py311-rhel9:sha256:a916006227256e1bb7ca45961906aac51a87c480ca21a9446e549cf56d218215 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda124-torch25-py311-rhel9:sha256:5dad91aca0bca6b71596b2d7f9e62df7049c00c6a2e8f94fd3b6a20eb659a29c | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda128-torch28-py312-rhel9:sha256:5c118be16bd4ae3860ebae64acecaac1988d8a474d00a7951f603a6c58e24038 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm62-torch24-py311-rhel9:sha256:1859e6721718dfd4bcb9015cee436853384b556f51339b439bc56adf42ffc2d3 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm62-torch25-py311-rhel9:sha256:2e7b526fb0c9ab8fc9bedbe313f7c8b44dba4fd647df515d7bca14f265644782 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm64-torch28-py312-rhel9:sha256:12b88af9a9a4672cb969d114108738e91ef446a2bade7be4a6e850c078ba6a94 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-gaudi-rhel9:sha256:30dd95f0c900b81b80e435796d82dd556814dd6d46c6b43b7dd879bcfdb8420e | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:sha256:8245032ce4cdc765fa85dfef7c6c2da69f1d1860d824981eccdca3bddcf6bc4d | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:sha256:6ae42ef0d5a9f33afcd58482bdfefb79630a7216e3315b666455ab586101cc5c | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:sha256:b0dc429ede9315ffa11ca3d75dd620746a860fe54090e6588008fd2b0b6c6755 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:sha256:75cb61e92fd90fb9c0dffbda67fd43b089cc2bf39eedcacc5ff09bfd04024c41 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:sha256:f818bea78b6625dd967ef8ea3ef914fdf48f50169e78590ea01d8aad0c9dc3f7 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:sha256:a4e27470683e611f9a48d97ed99223310876c2c9899fc031e3761f436d5822b0 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:sha256:8c992019d49325f304a04bbe85b3b269f31cb86d69c48a05e462521d68242ba3 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:sha256:118431b70712622eebc503820f1fbefea0f0b1932f12f20f2f05330025b353ce | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:sha256:fcfb4db43f18461159c3523a989178e34c190f1109f38af0f215017904bdaac8 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:sha256:21ce8b1d704b14c4d0c68fb2cd8db48d9e22e636a060fedc221f00980333de0a | * |
| Python-aiohttp | Ubuntu | esm-apps/bionic | * |
| Python-aiohttp | Ubuntu | esm-apps/focal | * |
| Python-aiohttp | Ubuntu | esm-apps/jammy | * |
| Python-aiohttp | Ubuntu | esm-apps/noble | * |
| Python-aiohttp | Ubuntu | esm-apps/xenial | * |
| Python-aiohttp | Ubuntu | jammy | * |
| Python-aiohttp | Ubuntu | noble | * |
| Python-aiohttp | Ubuntu | plucky | * |
| Python-aiohttp | Ubuntu | questing | * |
| Python-aiohttp | Ubuntu | upstream | * |