CVE-2026-47265
published 2026-06-02CVE-2026-47265: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.15%
4.7th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Affected
113 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | >= 0 < 3.14.0 | 3.14.0 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.13.x cookies origin validation (GHSA-hg6j-4rv6-33pg)
vuldb·2026-06-03·CVSS 6.6
CVE-2026-47265 [MEDIUM] aio-libs aiohttp up to 3.13.x cookies origin validation (GHSA-hg6j-4rv6-33pg)
A vulnerability was found in aio-libs aiohttp up to 3.13.x. It has been classified as problematic. This affects an unknown part. The manipulation of the argument cookies leads to origin validation error.
This vulnerability is documented as CVE-2026-47265. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
ghsa·2026-06-03
CVE-2026-47265 [MEDIUM] CWE-346 AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
### Summary
Cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.
### Impact
If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
### Workaround
If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
Red Hat
python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects
vendor_redhat·2026-06-02·CVSS 6.6
CVE-2026-47265 [MEDIUM] CWE-201 python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects
python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability allows a remote attacker to potentially gain access to sensitive information. When a developer uses the `cookies` parameter on a per-request basis, cookies are sent after following a cross-origin redirect. An attacker who controls a redirect can exploit this to leak sensitive data.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: exploit-intelligence-tech-previ
No detection rules found.
No public exploits indexed.
2026-06-02
Published