CVE-2025-69230: AIOHTTP Vulnerable to Cookie Parser Warning Storm
Summary Reading multiple invalid cookies can lead to a logging storm.
Impact If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.
----
Patch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69230?
CVE-2025-69230 is classified as a moderate severity vulnerability due to the potential for creating excessive logging.
How do I fix CVE-2025-69230?
To resolve CVE-2025-69230, upgrade to aiohttp version 3.13.3 or later.
What is the primary risk associated with CVE-2025-69230?
The primary risk of CVE-2025-69230 is the generation of a logging storm that can overwhelm logging systems.
Who is affected by CVE-2025-69230?
CVE-2025-69230 affects users of aiohttp versions 3.13.2 and earlier.
What type of attack is facilitated by CVE-2025-69230?
CVE-2025-69230 can facilitate a denial-of-service condition through excessive logging triggered by crafted Cookie headers.