CVE-2026-128125 json
AIOHTTP: Unbounded cookie storage in client CookieJar
published 5d ago modified 9h ago also EUVD-2026-125756 , GHSA-5pv8-vvhc-h7jv
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository aio-libs/aiohttp. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 6.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Patch / fix
- pypi aiohttp 3.14.4
- github.com/aio-libs/aiohttp@6963ee0 commit
- github.com/aio-libs/aiohttp@b1f6c87 commit
- github.com/aio-libs/aiohttp#13930 pull request
- github.com/aio-libs/aiohttp#13942 pull request
- github.com/aio-libs/aiohttp/releases/tag/v3.14.4 release
Is CVE-2026-128125 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10h ago
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | aiohttp | <=3.14.3 |
3.14.4 |
Affected products
- aio-libs aiohttp
Classification
- Weakness
-
- CWE-1325 Improperly Controlled Sequential Memory Allocation
References
- github.com /aio-libs/aiohttp/pull/13930
- github.com /aio-libs/aiohttp/pull/13942
- github.com /aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa
- github.com /aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
-
github.com
/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv
advisory
- github.com /aio-libs/aiohttp/releases/tag/v3.14.4
Sources
- CVE List CVE-2026-128125
- NVD CVE-2026-128125
- Maintainer advisory GHSA-5pv8-vvhc-h7jv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of aio-libs/aiohttp published their own advisory on GitHub. Reviewed sources take precedence over it.