Listen to this Post
This vulnerability operates within the `aiohttp.web` framework’s HTTP cookie parsing mechanism. When a client sends an HTTP request with a malformed `Cookie` header containing numerous invalid key-value pairs (e.g., lacking an ‘=’ sign or using incorrect delimiters), the `aiohttp.cookiejar` module’s parser fails to decode each invalid cookie. Each failure triggers the Python `logging` module to generate a distinct `aiohttp.server` warning log entry (“Can’t load cookie…”). An attacker can craft a single request with hundreds or thousands of such malformed cookie strings. When application code accesses the `request.cookies` attribute, it invokes the parser, resulting in a synchronous burst of warning log messages for each invalid entry. This “storm” can overwhelm log aggregation systems, cause disk space exhaustion from large log files, and induce minor performance degradation due to synchronous I/O operations during logging, effectively constituting a low-severity Denial-of-Service (DoS) against logging infrastructure.
Platform: AIOHTTP
Version: < 3.10.7
Vulnerability: Logging Storm DoS
Severity: Low
Date: 2026-01-05
Prediction: Patched 2026-01-05
What Undercode Say:
Analytics
Crafting an exploit request
curl -H "Cookie: $(python3 -c "print('; '.join(['malformed_cookie' for _ in range(1000)]))")" http://target/
Monitoring log growth
tail -f /var/log/app.log | grep "Can't load cookie"
watch -n 1 'du -sh /var/log/app.log'
How Exploit:
Attacker sends request with thousands of malformed cookies. Application code accesses request.cookies. Parser fails on each cookie. Logger writes warning for each failure. Log volume spikes dramatically.
Protection from this CVE
Update to aiohttp>=3.10.7. Implement web application firewall (WAF) rules to reject requests with excessive cookie headers. Configure log level for `aiohttp.server` to ERROR. Use log rate limiting.
Impact:
Log file overflow. Monitoring system spam. Minor performance impact. No code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
