{"id":"GHSA-5pv8-vvhc-h7jv","kind":"vulnerability","aliases":["GHSA-5pv8-vvhc-h7jv"],"related":[],"title":"Unbounded cookie storage in client CookieJar","description":"### Summary\r\n\r\n`Set-Cookie` parsing created additional cookies from unrecognised `name=value` attributes, and `CookieJar` had no limit on the number of cookies stored or sent. A server could make the client store a very large number of cookies and generate very large `Cookie` headers.\r\n\r\n### Impact\r\n\r\nA malicious server could cause excessive memory and CPU use in a client, repeated on every redirect, and cause later requests to the same domain to build an excessively large `Cookie` header.\r\n\r\n---\r\n\r\nPatch: https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa","summary":"aiohttp's client parsed unrecognised Set-Cookie attributes as extra cookies and its CookieJar had no cap on how many it stored or sent. A malicious server can make the client store huge numbers of cookies and build very large Cookie headers, using excessive memory and CPU.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":"<= 3.14.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-1325","http-client","package","python"],"not_affected_if":["aiohttp-3.14.4-or-later","server-only-use"],"how_to_check":"- Run `pip show aiohttp` and check whether the version is `3.14.3` or older.\n- Search the project's requirements or lock files for `aiohttp`.","fix":"- `aiohttp` `3.14.4`","status":"open","published_at":"2026-11-08T18:44:21+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","triaged_at":"2026-11-09T22:58:33+00:00","updated_at":"2026-11-09T22:58:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:58:33Z","model":"claude-haiku-5-5","output":{"fix":"- `aiohttp` `3.14.4`","reach":"network","title":"aiohttp: unbounded cookie storage lets a server exhaust client memory","impact":"low","summary":"aiohttp's client parsed unrecognised Set-Cookie attributes as extra cookies and its CookieJar had no cap on how many it stored or sent. A malicious server can make the client store huge numbers of cookies and build very large Cookie headers, using excessive memory and CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","aiohttp","http-client"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"a malicious server exhausts client memory and CPU","analyst_note":"","how_to_check":"- Run `pip show aiohttp` and check whether the version is `3.14.3` or older.\n- Search the project's requirements or lock files for `aiohttp`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["server-only-use","aiohttp-3.14.4-or-later"],"who_is_affected":"Any application using aiohttp's client (ClientSession with its default cookie jar) to contact servers it does not fully trust. The risk is a client-side resource drain on the calling process, repeated on every redirect and on later requests to the same domain. Servers-only use of aiohttp that never acts as an HTTP client is not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000731,"input_tokens":4723,"output_tokens":518,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-1325':20B '/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa':155C '5pv8':9A,14A 'addit':80C 'aiohttp':17A,18B,26B 'attribut':34B,86C 'build':64B,146C 'cap':43B 'caus':124C,138C 'client':5A,23B,28B,57B,105C,132C 'cooki':2A,33B,37B,62B,67B,77C,81C,96C,112C,117C,150C 'cookiejar':6A,40B,88C 'could':102C,123C 'cpu':73B,128C 'creat':79C 'cwe':19B 'domain':144C 'everi':135C 'excess':70B,125C,148C 'extra':36B 'generat':114C 'ghsa':8A,13A 'ghsa-5pv8-vvhc-h7jv':7A,12A 'github.com':154C 'github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa':153C 'h7jv':11A,16A 'header':68B,118C,151C 'http':22B 'http-client':21B 'huge':59B 'impact':119C 'larg':66B,109C,116C,149C 'later':139C 'limit':91C 'make':55B,103C 'malici':52B,121C 'mani':46B 'memori':71B,126C 'name':84C 'number':60B,94C,110C 'packag':24B 'pars':29B,78C 'patch':152C 'python':25B 'redirect':136C 'repeat':133C 'request':140C 'sent':50B,99C 'server':53B,101C,122C 'set':32B,76C 'set-cooki':31B,75C 'storag':3A 'store':48B,58B,97C,106C 'summari':74C 'unbound':1A 'unrecognis':30B,83C 'use':69B,129C 'valu':85C 'vvhc':10A,15A","nicknames":[],"mitigations":[],"who_affected":"Any application using aiohttp's client (ClientSession with its default cookie jar) to contact servers it does not fully trust. The risk is a client-side resource drain on the calling process, repeated on every redirect and on later requests to the same domain. Servers-only use of aiohttp that never acts as an HTTP client is not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aiohttp"],"ptokens":["aiohttp"],"labels":["aiohttp","cwe1325","httpclient","low","package","pypi","python"],"campaign_type":null,"search_a":"'5pv8':9A,14A 'aiohttp':17A 'client':5A 'cooki':2A 'cookiejar':6A 'ghsa':8A,13A 'ghsa-5pv8-vvhc-h7jv':7A,12A 'h7jv':11A,16A 'storag':3A 'unbound':1A 'vvhc':10A,15A","search_b":"'-1325':20B 'aiohttp':18B,26B 'attribut':34B 'build':64B 'cap':43B 'client':23B,28B,57B 'cooki':33B,37B,62B,67B 'cookiejar':40B 'cpu':73B 'cwe':19B 'excess':70B 'extra':36B 'header':68B 'http':22B 'http-client':21B 'huge':59B 'larg':66B 'make':55B 'malici':52B 'mani':46B 'memori':71B 'number':60B 'packag':24B 'pars':29B 'python':25B 'sent':50B 'server':53B 'set':32B 'set-cooki':31B 'store':48B,58B 'unrecognis':30B 'use':69B","search_c":"'/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa':155C 'addit':80C 'attribut':86C 'build':146C 'caus':124C,138C 'client':105C,132C 'cooki':77C,81C,96C,112C,117C,150C 'cookiejar':88C 'could':102C,123C 'cpu':128C 'creat':79C 'domain':144C 'everi':135C 'excess':125C,148C 'generat':114C 'github.com':154C 'github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa':153C 'header':118C,151C 'impact':119C 'larg':109C,116C,149C 'later':139C 'limit':91C 'make':103C 'malici':121C 'memori':126C 'name':84C 'number':94C,110C 'pars':78C 'patch':152C 'redirect':136C 'repeat':133C 'request':140C 'sent':99C 'server':101C,122C 'set':76C 'set-cooki':75C 'store':97C,106C 'summari':74C 'unrecognis':83C 'use':129C 'valu':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:44:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-5pv8-vvhc-h7jv","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv","severity":"low","published_at":"2026-11-08T18:44:21+00:00","modified_at":"2026-11-08T18:44:22+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","fetched_at":"2026-11-09T22:53:22+00:00","note":null}],"documents":[{"id":110552,"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}