CVE-2025-69223: Puff, The Magic Dragon: Exploding RAM with aiohttp Zip Bombs

#security #cve #cybersecurity

Puff, The Magic Dragon: Exploding RAM with aiohttp Zip Bombs

Vulnerability ID: CVE-2025-69223
CVSS Score: 7.5
Published: 2026-01-05

A classic 'Zip Bomb' vulnerability in the popular Python aiohttp framework allowing unauthenticated attackers to exhaust server memory via highly compressed payloads.

TL;DR

aiohttp versions <= 3.13.2 failed to cap the output size of decompressed request bodies. By sending a small, highly compressed payload (gzip, deflate, brotli), an attacker can force the server to allocate gigabytes of memory, triggering an OOM crash and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

CWE: CWE-409 (Improper Handling of Highly Compressed Data)
CVSS: 7.5 (High)
Attack Vector: Network
Exploit Status: PoC Available
Impact: Denial of Service (DoS)
Patch: v3.13.3

Affected Systems

aiohttp <= 3.13.2
aiohttp: <= 3.13.2 (Fixed in: 3.13.3)

Code Analysis

Commit: 2b920c3

Fix for CVE-2025-69223: Added max_decompress_size limit to HTTP parser

@@ -0,0 +1,5 @@
+        chunk = self.decompressor.decompress_sync(
+            chunk, max_length=self._max_decompress_size + 1
+        )
+    if len(chunk) > self._max_decompress_size:
+        raise DecompressSizeError(...)

Exploit Details

GitHub (Official Regression Test): Regression test added in the patch demonstrating the vulnerability trigger.

Mitigation Strategies

Input Validation
Resource Quotas
Attack Surface Reduction

Remediation Steps:

Update aiohttp to version 3.13.3 or later via pip install --upgrade aiohttp.
If utilizing a reverse proxy (Nginx, AWS ALB), consider stripping Content-Encoding headers if compression is not required for upstream communication.
Monitor application memory usage and alert on rapid spikes.

References

Read the full report for CVE-2025-69223 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community