Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | No fix yet | — |
| Debian 13 | python-aiohttp | No fix yet | — |
| Debian 12 | python-aiohttp | No fix yet | — |
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv
- https://github.com/aio-libs/aiohttp/pull/13930
- https://github.com/aio-libs/aiohttp/pull/13942
- https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa
- https://github.com/aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4