Vulnerability Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aiohttp | Aiohttp | < 3.14.0 |
Related Weaknesses (CWE)
References
- https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32Patch
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pgMitigationPatchVendor Advisory
FAQ
What is CVE-2026-47265?
CVE-2026-47265 is a vulnerability with a CVSS score of 7.5 (HIGH). AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin re...
How severe is CVE-2026-47265?
CVE-2026-47265 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47265?
Check the references section above for vendor advisories and patch information. Affected products include: Aiohttp Aiohttp.