AIOHTTP · GHSA-5pv8-vvhc-h7jv · Package
FIX → 3.14.4
aiohttp's client parsed unrecognised Set-Cookie attributes as extra cookies and its CookieJar had no cap on how many it stored or sent. A malicious server can make the client store huge numbers of cookies and build very large Cookie headers, using excessive memory and CPU.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application using aiohttp's client (ClientSession with its default cookie jar) to contact servers it does not fully trust. The risk is a client-side resource drain on the calling process, repeated on every redirect and on later requests to the same domain. Servers-only use of aiohttp that never acts as an HTTP client is not exposed.
Not affected if aiohttp-3.14.4-or-later, server-only-use
Who cares aiohttp, http-client, python
pip show aiohttp and check whether the version is 3.14.3 or older.aiohttp.Upgrade to 3.14.4
aiohttp 3.14.4Set-Cookie parsing created additional cookies from unrecognised name=value attributes, and CookieJar had no limit on the number of cookies stored or sent. A server could make the client store a very large number of cookies and generate very large Cookie headers.
A malicious server could cause excessive memory and CPU use in a client, repeated on every redirect, and cause later requests to the same domain to build an excessively large Cookie header.
Patch: https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.