CVE-2026-128125

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4

Description Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, and the CookieJar does not limit the number of cookies stored or sent. A malicious server can cause a client to accumulate an excessively large cookie set, leading to repeated memory and CPU consumption during redirects and the construction of an oversized Cookie header for subsequent requests to the same domain.

Recommendations Update to version 3.14.4.