AIOHTTP Asynchronous Framework Vulnerability in Python
CVE-2025-69230

2.7LOW

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
5 January 2026

What is CVE-2025-69230?

A vulnerability has been identified in AIOHTTP, an asynchronous HTTP client/server framework for Python. In versions 3.13.2 and earlier, an attacker could exploit this vulnerability by sending specially crafted Cookie headers that trigger excessive warning-level log entries when the cookies attribute is accessed. This can lead to a logging storm that may clutter application logs, complicating the identification of legitimate warnings and issues. Users are advised to upgrade to version 3.13.3 or later to mitigate this issue.

Affected Version(s)

aiohttp < 3.13.3

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/64629a0834f94e...
x_refsource_MISC

CVSS V4

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.