CVE-2026-47265
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Jun 2, 2026
CISA due date
—
The record
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-aiohttp | 0 | 3.11.16-160000.5.1 |
Related vulnerabilities
- CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34519 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34525 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34518 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34520 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34514 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34516 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34517 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp