AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the hosts memory. This issue is fixed in version 3.13.3.
Weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aiohttp | Aiohttp | * | 3.13.3 (excluding) |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | RedHat | automation-controller-0:4.5.30-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | RedHat | automation-controller-0:4.5.30-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | automation-controller-0:4.6.25-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | python3.12-aiohttp-0:3.13.3-2.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | automation-controller-0:4.6.25-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | python3.12-aiohttp-0:3.13.3-2.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | automation-controller-0:4.7.8-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-aiohttp-0:3.13.3-2.el9ap | * |
| Red Hat AI Inference Server 3.2 | RedHat | rhaiis/vllm-cuda-rhel9:1772160593 | * |
| Red Hat AI Inference Server 3.2 | RedHat | rhaiis/vllm-rocm-rhel9:1772160625 | * |
| Red Hat Ansible Automation Platform 2.4 | RedHat | ansible-automation-platform-24/controller-rhel8:1768524420 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/controller-rhel8:1768871210 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/lightspeed-chatbot-rhel8:1774414699 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/lightspeed-rhel8:1774446874 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/controller-rhel9:1768890500 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/de-minimal-rhel9:1768846975 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/de-supported-rhel9:1768853828 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-minimal-rhel9:1772499904 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-supported-rhel9:1772508458 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/hub-rhel9:1772473168 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-chatbot-rhel9:1774417022 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-chatbot-rhel9:1774417022 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-feature-server-rhel9:1776338381 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-cpu-rhel9:1776259063 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:1770055932 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ml-pipelines-runtime-generic-rhel9:1770103375 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-openvino-model-server-rhel9:1770054044 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1770055428 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:1770103255 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1770053703 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1770053831 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1770053721 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1770053740 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1770053864 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ta-lmes-job-rhel9:1770245096 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-cuda-rhel9:1770059269 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-rocm-rhel9:1770053785 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1770055405 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1770055397 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1770053733 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:1770053728 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1770053730 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1770053829 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1770053864 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1770053748 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1770053723 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1770055425 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-ml-pipelines-runtime-generic-rhel9:1770786633 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-openvino-model-server-rhel9:1770621450 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-caikit-tgis-serving-rhel9:1772093250 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-cpu-rhel9:1778264363 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:1771840993 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-openvino-model-server-rhel9:1771608633 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1771502869 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:1771502930 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1771502912 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1771502889 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1771502843 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1771502897 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1771502844 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda121-torch24-py311-rhel9:1771498500 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda124-torch25-py311-rhel9:1771498500 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-cuda128-torch28-py312-rhel9:1771498575 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm62-torch24-py311-rhel9:1771498574 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm62-torch25-py311-rhel9:1771498638 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-training-rocm64-torch28-py312-rhel9:1771498636 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-gaudi-rhel9:1770956034 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1771502870 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1771511331 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1771502906 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:1771502921 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1771502845 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1771502863 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1771502906 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1771502910 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1771502884 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1771874181 | * |
| Python-aiohttp | Ubuntu | esm-apps-legacy/xenial | * |
| Python-aiohttp | Ubuntu | esm-apps/bionic | * |
| Python-aiohttp | Ubuntu | esm-apps/focal | * |
| Python-aiohttp | Ubuntu | esm-apps/jammy | * |
| Python-aiohttp | Ubuntu | esm-apps/noble | * |
| Python-aiohttp | Ubuntu | esm-apps/xenial | * |
| Python-aiohttp | Ubuntu | jammy | * |
| Python-aiohttp | Ubuntu | noble | * |
| Python-aiohttp | Ubuntu | plucky | * |
| Python-aiohttp | Ubuntu | questing | * |
| Python-aiohttp | Ubuntu | upstream | * |
References
- https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:1249
- https://access.redhat.com/errata/RHSA-2026:1497
- https://access.redhat.com/errata/RHSA-2026:1506
- https://access.redhat.com/errata/RHSA-2026:1596
- https://access.redhat.com/errata/RHSA-2026:1599
- https://access.redhat.com/errata/RHSA-2026:1609
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:2106
- https://access.redhat.com/errata/RHSA-2026:2695
- https://access.redhat.com/errata/RHSA-2026:3461
- https://access.redhat.com/errata/RHSA-2026:3462
- https://access.redhat.com/errata/RHSA-2026:3713
- https://access.redhat.com/errata/RHSA-2026:3782
- https://access.redhat.com/errata/RHSA-2026:3958
- https://access.redhat.com/errata/RHSA-2026:3959
- https://access.redhat.com/errata/RHSA-2026:3960
- https://access.redhat.com/errata/RHSA-2026:6308
- https://access.redhat.com/errata/RHSA-2026:6309
- https://access.redhat.com/security/cve/CVE-2025-69223
- https://bugzilla.redhat.com/show_bug.cgi?id=2427456
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69223.json