CVE-2026-128125: AIOHTTP: Unbounded cookie storage in client CookieJar
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
aiohttp client applications that connect to malicious or untrusted HTTP servers are exposed, particularly when they retain a CookieJar across redirects or later requests to the same domain. The issue concerns client-side cookie handling rather than aiohttp operating as a server.
What does an attacker need to exploit this?
An attacker needs to control, or induce the client to connect to, an HTTP server that returns crafted Set-Cookie headers containing unrecognized name=value attributes. No client-side privileges or user interaction are required, but the supplied vector indicates an attack prerequisite.
What is the impact if exploitation succeeds?
The client can accumulate a very large cookie collection, causing memory and CPU consumption that can recur during redirects. It may also send an excessively large Cookie header on subsequent requests to the same domain, affecting availability.
What should teams do if they cannot patch immediately?
Limit aiohttp clients' connections to untrusted or attacker-controlled servers where possible, and avoid retaining cookie state for such requests. The described behavior is driven by an unrestricted CookieJar, so isolating or disabling persistent cookie handling for untrusted destinations can reduce exposure.
How can I determine whether I am affected?
Check whether the application uses aiohttp versions earlier than 3.14.4 and makes outbound requests to untrusted domains while using cookie handling. Evidence may include unusually large in-memory cookie sets, repeated redirect-related CPU or memory growth, or abnormally large outgoing Cookie headers.