CVE-2026-47265: AIOHTTP vulnerable to cross-origin redirect with per-request cookies
Summary
Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.
Impact
If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
Workaround
If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.0 - Upgrade
Upgrade
aio-libs/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.0Patch f54c40851b0d6c4bbdab97ba518a223adda32478 - Configuration
If unable to upgrade to 3.14.0, avoid using the per-request `cookies` parameter; instead set the `Cookie` header via the `headers` parameter to prevent sending cookies after a cross-origin redirect.
aiohttp cookies parameter vs Cookie header = Use Cookie header in headers parameter instead of cookies parameter on a per-request basis
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47265?
CVE-2026-47265 has a severity score of medium (6.6) according to the CVSS version 4.0.
How does CVE-2026-47265 affect AIOHTTP applications?
CVE-2026-47265 allows sensitive data from per-request cookies to be sent after following cross-origin redirects, potentially exposing this information.
How do I fix CVE-2026-47265?
To remediate CVE-2026-47265, upgrade AIOHTTP to version 3.14.0 or later.
What versions of AIOHTTP are affected by CVE-2026-47265?
CVE-2026-47265 affects all versions of AIOHTTP prior to version 3.14.0.
Is CVE-2026-47265 a critical vulnerability?
CVE-2026-47265 is not considered critical, but it poses risks due to the potential exposure of sensitive data.