| Package | Affected versions | Patched versions |
|---|---|---|
| aiohttp | < 3.13.3 | 3.13.3 |
| aiohttp | ≥ 3.12.7, < 3.13.3 | 3.13.3 |
Reading multiple invalid cookies can lead to a logging storm.
If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.
Patch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free