CVE-2018-1000814: aiohttp-session - Non-expiring sessions / Infinite lifespan
Summary
CVE-2018-1000814: aiohttp-session creates non-expiring sessions. Affects aiohttp-session versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp-session is a Python package that provides session support for aiohttp web applications. It allows developers to manage user sessions and store session data. The package is widely used in Python web development projects.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000814, affects aiohttp-session versions 2.6.0 and earlier. It specifically impacts the EncryptedCookieStorage and NaClCookieStorage components of the package. The vulnerability allows for non-expiring sessions or infinite lifespan. An attacker can recreate a cookie with the same value after its expiry, resulting in sessions that never expire. This vulnerability can be exploited to maintain unauthorized access to user sessions and potentially compromise user data.
How To Fix
Latest published version: 2.12.1 as of 22 Oct 2026
pip install --upgrade "aiohttp-session==2.12.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.0
This is the first release that contains the fix.
pip install --upgrade "aiohttp-session==2.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of aiohttp-session to ensure the security of user sessions.
Conclusion
The vulnerability in aiohttp-session can lead to non-expiring sessions and potential unauthorized access to user data. It is recommended to update to version 2.7.0 or later to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp-session →
FAQ
aiohttp-session is a Python package that provides session support for aiohttp web applications. It allows developers to manage user sessions and store session data.
Versions 2.6.0 and earlier of aiohttp-session are affected by this vulnerability.
The vulnerability allows for non-expiring sessions or infinite lifespan. An attacker can recreate a cookie with the same value after its expiry, resulting in sessions that never expire. This can lead to unauthorized access and potential compromise of user data.
To fix this vulnerability, update aiohttp-session to version 2.7.0 or later.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of aiohttp-session.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp-session.
