Cyber Resilience

CVE-2025-69230

Aiohttp ≤ 3.13.3

Published
06 January 2026
Modified
14 January 2026
Patch / advisory
View advisory
CVSS Score v4 2.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0034 27th percentile
Risk Priority 33 floored blend · peak EPSS

Summary

CVE-2025-69230 is a low-severity Logging of Excessive Data (CWE-779) vulnerability in Aiohttp Aiohttp. Its CVSS base score is 2.7 (Low).

Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AU-2 (Event Logging) and AU-7 (Audit Record Reduction and Report Generation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be…

more

able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.

CWE(s)
CWE-779

Related Threats

CVEs Like This One

CVE-2024-52303Same product: Aiohttp Aiohttp
CVE-2026-54279Same product: Aiohttp Aiohttp
CVE-2025-69228Same product: Aiohttp Aiohttp
CVE-2026-50269Same product: Aiohttp Aiohttp
CVE-2025-69229Same product: Aiohttp Aiohttp
CVE-2026-54275Same product: Aiohttp Aiohttp
CVE-2026-54278Same product: Aiohttp Aiohttp
CVE-2023-37276Same product: Aiohttp Aiohttp
CVE-2025-69226Same product: Aiohttp Aiohttp
CVE-2026-34516Same product: Aiohttp Aiohttp

Affected Assets

aiohttp
aiohttp
≤ 3.13.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AU-2 Event Logging good match

Defining the exact event types to be logged prevents indiscriminate collection of excessive data.

AU-7 Audit Record Reduction and Report Generation good match

Audit-record reduction and on-demand reporting directly reduce the impact of overly verbose logs during review.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-04 mostly match
degrades

Excessive logging hinders log processing and forensic analysis, largely undermining DE.AE-04's ability to estimate impact/scope via SIEMs or tools while removing most of that outcome's efficacy.

DE.AE-02 partial match
degrades

Excessive logging undermines event analysis by flooding logs with noise that hinders processing and forensic review, but does not blind or defeat the outcome the way insufficient logging would.

DE.AE-06 partial match
degrades

Excessive logging impairs processing of provided event data and log-analysis findings (one aspect of DE.AE-06) without fully defeating alert/ticket distribution.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging mostly match
prevents

A.8.15 directly requires logging to be configured so that only necessary events are recorded, preventing excessive data.

A.5.37 Documented operating procedures partial match
prevents

Documented operating procedures can include logging guidelines, indirectly reducing excessive logging.

A.8.16 Monitoring activities partial match
prevents

Monitoring activities can detect excessive logging but do not prescribe how much data should be logged.

References