{"id":"CVE-2025-69230","title":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python","summary":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an a…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-779"],"vendor":"aiohttp","product":"aiohttp","affected":["aiohttp >= 3.12.7, < 3.13.3"],"patched":["aiohttp 3.13.3"],"published":"2026-01-06","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:11:10.487","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230","references":[{"url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326","label":"security-advisories@github.com"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["nvd","osv","pip"],"epss":0.00369,"epssPercentile":0.30748,"aliases":["GHSA-fh55-r93g-j68g","PYSEC-2026-1105"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:48.908Z","slug":"CVE-2025-69230","body":"## Overview\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.\n\n## Affected\n\n- `aiohttp >= 3.12.7, < 3.13.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `aiohttp 3.13.3`\n\n## Package advisory (CVE-2025-69230)\n\nAffected packages:\n\n- `aiohttp < 3.13.3`\n\nPatched in:\n\n- `aiohttp 3.13.3`\n\nSource: https://osv.dev/vulnerability/GHSA-fh55-r93g-j68g","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206425,"id":"CVE-2025-69230","ts":1789665846055,"field":"cvss","old":null,"new":"5.3"},{"seq":206424,"id":"CVE-2025-69230","ts":1789665846055,"field":"severity","old":"low","new":"medium"}]}