What is GHSA-fh55-r93g-j68g?

GHSA-fh55-r93g-j68g is a security advisory published by GitHub Security Advisories with Low severity. AIOHTTP Vulnerable to Cookie Parser Warning Storm

Which CVE IDs does GHSA-fh55-r93g-j68g cover?

GHSA-fh55-r93g-j68g covers the following CVE IDs: CVE-2025-69230. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fh55-r93g-j68g?

GHSA-fh55-r93g-j68g affects 1 product, including: pip/aiohttp:\u003c= 3.13.2.

GHSA-fh55-r93g-j68gLow

AIOHTTP Vulnerable to Cookie Parser Warning Storm

Vendor

GitHub Security Advisories

Published

January 5, 2026

Last Modified

January 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-69230 →

📋 Description

Summary

Reading multiple invalid cookies can lead to a logging storm.

Impact

If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.

Patch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326

🎯 Affected products1

pip/aiohttp:<= 3.13.2

🔗 References (4)

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g
https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326
https://nvd.nist.gov/vuln/detail/CVE-2025-69230
https://github.com/advisories/GHSA-fh55-r93g-j68g