Cookie Parsing Vulnerability in AIOHTTP by aio-libs

CVE-2026-128125

What is CVE-2026-128125?

AIOHTTP, an asynchronous HTTP client/server framework for Python, is susceptible to a vulnerability in its cookie parsing mechanism. Prior to version 3.14.4, unrecognized name=value attributes in Set-Cookie headers were incorrectly treated as separate cookies. This flaw allows a malicious server to force an aiohttp client into accumulating an excessively large set of cookies, leading to memory and CPU resource exhaustion across multiple redirects. Consequently, this can provoke the generation of an oversized Cookie header for subsequent requests to the same domain, potentially disrupting application performance and leading to denial of service. Users are advised to upgrade to version 3.14.4 or later to mitigate this issue.

References