CVE-2025-69230
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.
Scoring
- Severity
- LOW
- CVSS base score
- 2.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
- EPSS probability
- 0.37%
- CWE
- CWE-779
- Published
- 2026-01-05
- Last modified
- 2026-03-13
Affected products
- aio-libs aiohttp
Weakness type
Related vulnerabilities
- CVE-2026-86200 — PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
- CVE-2026-20210 — Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
- CVE-2026-20209 — Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
- CVE-2026-28718 — Denial of service due to insufficient input validation in authentication logging. The following...
- CVE-2025-8696 — DoS attack against the Stork UI from an unauthenticated user
- CVE-2025-53636 — Open OnDemand Shell App closed websocket DoS
- CVE-2024-55628 — Suricata oversized resource names utilizing DNS name compression can lead to resource starvation
- CVE-2024-36416 — SuiteCRM v4 API Excessive log data DOS