AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| aio-libs | aiohttp | affected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Aio-libs | Aiohttp Session | — |
| Aio-libs Project | Aiohttp | — |
| Aiohttp | Aio-libs | — |
| Aiohttp | Aiohttp | — |
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4876-1 | python-aiohttp security update |
Debian DSA |
DSA-6141-1 | python-aiohttp security update |
Github GHSA |
GHSA-6mq8-rvhq-8wgg | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
Ubuntu USN |
USN-8032-1 | AIOHTTP vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.583% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Aio-libs
Aio-libs aiohttp Session Aio-libs Project Aio-libs Project aiohttp Aiohttp Aiohttp aio-libs Aiohttp aiohttp |
|
| Vendors & Products |
Aio-libs
Aio-libs aiohttp Session Aio-libs Project Aio-libs Project aiohttp Aiohttp Aiohttp aio-libs Aiohttp aiohttp |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3. | |
| Title | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | |
| Weaknesses | CWE-409 CWE-770 |
|
| References |
| |
| Metrics |
cvssV3_1
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Jan 6, 2026, 2:16 PM
Debian DLA
Debian DSA
Github GHSA
Ubuntu USN