Vulnerability Details CVE-2025-69230
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.7%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2025-69230
-
cpe:2.3:a:aiohttp:aiohttp:3.12.10
-
cpe:2.3:a:aiohttp:aiohttp:3.12.11
-
cpe:2.3:a:aiohttp:aiohttp:3.12.12
-
cpe:2.3:a:aiohttp:aiohttp:3.12.13
-
cpe:2.3:a:aiohttp:aiohttp:3.12.14
-
cpe:2.3:a:aiohttp:aiohttp:3.12.15
-
cpe:2.3:a:aiohttp:aiohttp:3.12.7
-
cpe:2.3:a:aiohttp:aiohttp:3.12.8
-
cpe:2.3:a:aiohttp:aiohttp:3.12.9
-
cpe:2.3:a:aiohttp:aiohttp:3.13.0
-
cpe:2.3:a:aiohttp:aiohttp:3.13.1
-
cpe:2.3:a:aiohttp:aiohttp:3.13.2