AIOHTTP Cookie Parser Warning Storm Vulnerability
Summary
GHSA-fh55-r93g-j68g: AIOHTTP Vulnerable to Cookie Parser Warning Storm. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle web requests and responses efficiently. It provides a simple interface for building web applications and services. However, it has a vulnerability related to its cookie parsing mechanism, which can lead to excessive logging when invalid cookies are processed.
Vulnerability Detail
The vulnerability arises when the 'cookies' attribute is accessed in an AIOHTTP application. An attacker can exploit this by sending specially crafted Cookie headers that contain multiple invalid cookies. This can trigger a storm of warning-level logs, overwhelming the logging system and potentially obscuring other important log messages. The issue is classified under CWE-779, which pertains to improper handling of cookies.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement logging filters to suppress warning messages related to cookie parsing until you can update to the patched version. Here is an example of how to set up a logging filter in Python:
import logging
class CookieWarningFilter(logging.Filter):
def filter(self, record):
return 'Cookie' not in record.getMessage()
logging.getLogger().addFilter(CookieWarningFilter())
Conclusion
The AIOHTTP cookie parser vulnerability can lead to excessive logging when invalid cookies are processed. It is crucial to update to version 3.13.3 or later to mitigate this issue. Implementing logging filters can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The affected versions of AIOHTTP are those up to and including 3.13.2. Version 3.13.3 and later contain the fix.
The primary impact is a logging storm that can obscure important log messages, making it difficult to monitor application behavior and troubleshoot issues.
Yes, you can implement a logging filter to suppress warning messages related to cookie parsing until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
