https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T17:10:50.770920+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-6mq8-rvhq-8wgg GHSA-6mq8-rvhq-8wgg — AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 2026-10-03T17:10:50.773504+00:00

Affected: PyPI: aiohttp

### Summary A zip bomb can be used to execute a DoS against the aiohttp server.

### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

------

Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a