CVE-2026-128125

Name	CVE-2026-128125
Description	AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1153954

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-aiohttp (PTS)	bookworm	3.8.4-1+deb12u1	vulnerable
	bookworm (security)	3.8.4-1+deb12u2	vulnerable
	trixie (security), trixie	3.11.16-1+deb13u1	vulnerable
	forky, sid	3.14.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-aiohttp	source	(unstable)	(unfixed)			1153954

Notes

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv
https://github.com/aio-libs/aiohttp/pull/13942
Fixed by: https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa (v3.14.4)