Improperly Controlled Sequential Memory Allocation in aiohttp - #VU162575
Published: November 9, 2026
Vulnerability identifier: #VU162575
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1325
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause excessive memory and CPU use in an aiohttp client.
The vulnerability exists due to unbounded CookieJar storage and Set-Cookie parsing that creates extra cookies from unrecognized name=value attributes in server responses. An unauthenticated remote attacker can supply these responses from a server the client contacts, causing repeated resource consumption on redirects and excessively large Cookie headers in later requests to the same domain.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4