VDB
RHSA-2026:59159
RHSA-2026:59159
PUBLISHED
CVSS 7.5 HIGH
A decompression based denial of service flaw has been discovered in the AIOHTTP python library. Library versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:f3fdccec68a0cea216f2e5e467ee4f0fffc09dd15d40d89cb0198078be0100ea_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8-operator@sha256:1ed4c42ff8ae2ec0e1403054851d0e683bd3626f17655c889585af56eae1f7d4_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/controller-rhel8-operator@sha256:5d0cfa56290410825677160e1455d1b75e237d2531b4182d3f0bb17fa804ad32_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/de-supported-rhel8@sha256:c6546c64cd7295ccb1e65fc996e90800d442d7b3b9aa459ac40b3fdc048699e5_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/platform-resource-runner-rhel8@sha256:25fa097b72f7de64c03a279a913df573e04e38c598003f91fe979d558dae4c68_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/gateway-rhel8@sha256:36485166e4d7ab6b06bbf246ffcf0fdd9884467dcec1b7052e334764fdc448e3_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8-operator@sha256:2e914a2b908a5c7e139d1ac864b47dba4575db8c6c528fdd695c00f9bac5ee9a_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/platform-resource-rhel8-operator@sha256:1bbfdf1804c2e5cb02e9f198ec047de69d9f6183a49dcd4b385101dc497abead_amd64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:b8482cbc57372d309703b38ed05458dea0f11cf8d3bffd98e96d09b5756c320c_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8-operator@sha256:eafb69e22816cd81d175ea3899cdb6767d7a7c5869fcb0323d7621bd2dd10338_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/platform-resource-rhel8-operator@sha256:5d1ab9592eda785538e6da7227b31b9162cf56da1e369ebe120ac2b4c885b7b5_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8-operator@sha256:cdf67e546c626d182b3abcb405fb4ba39aa0651a4feef42ef08d994bf796d524_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8@sha256:166555e99754eb88a806c9baca668646fe87ec060100309c94df4c283e8be107_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/gateway-proxy-rhel8@sha256:c01e99c2cede5f0860f47e20e0e4156dc9fa4f3b0fc06e96d878040a4a8d1041_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8@sha256:e5d41ab99d3fda275110a78fc4e8ea6553779db5bdd8767af83f9cd6381a6dba_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/gateway-rhel8@sha256:494a972f0f8fb7c6551626162b127d80bffff56293ce568920b377efc59afee0_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/de-supported-rhel8@sha256:6dabd247b5cf55c951fae600ade190cdf79231050ce3c4ca2ee2e63ad480286e_s390x as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:463a4d49f9c556d9f460f0cd4baef3becc987e6bf90ae1262834a2ff4610f889_ppc64le as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8@sha256:a7950b455429e51a1006251f35742e3e3bb60d5d732a67f9bfb053f1a2c75b9a_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-25/platform-resource-runner-rhel8@sha256:d8ebcd203b6aa3c1b86d637d0ccbf917454e999c47ede1e5dc35a8c5e3dd4ca6_arm64 as a component of Red Hat Ansible Automation Platform 2.5 | * |
…and 82 more
Timeline
- Aug 24, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59159 advisory
- https://access.redhat.com/security/cve/CVE-2025-69223 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-15307 advisory
- https://access.redhat.com/security/cve/CVE-2026-34070 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/cve/CVE-2026-67325 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69244 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59159.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2427456 issue
- https://www.cve.org/CVERecord?id=CVE-2025-69223 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-69223 advisory
- https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a advisory
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2506433 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14257 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14257 advisory
…and 45 more