CVE-2026-128125
Received Received - Intake

Memory Exhaustion via Cookie Parsing in AIOHTTP

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128125
EUVD
EUVD-2026-125756

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aiohttp aiohttp to 3.14.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1325 The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AIOHTTP versions before 3.14.4 have a flaw in Set-Cookie parsing where unrecognized attributes are treated as additional cookies. This allows a malicious server to send excessive cookies, causing memory and CPU consumption in clients during redirects. The client also builds an overly large Cookie header for future requests to the same domain.

Detection Guidance

Monitor for unusually large Cookie headers or excessive memory/CPU usage in aiohttp clients. Check for redirects from untrusted domains that may trigger cookie accumulation. Inspect server responses for Set-Cookie headers with unexpected attributes.

Impact Analysis

If you use an affected AIOHTTP version, a malicious server could degrade your application's performance by consuming resources during redirects. It may also lead to denial-of-service conditions due to excessive memory and CPU usage.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later. Implement rate limiting and cookie size restrictions in client configurations. Validate and sanitize server responses to prevent malicious Set-Cookie headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...