Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-34518: aiohttp can expose cookies during cross-site redirects
CVE-2026-34518 · published 7 months ago
Summary
If your Python applications use aiohttp version earlier than 3.13.4, the library may keep sending your website's cookies and proxy credentials when it follows a redirect to a different website. This could allow the other site to see information that should stay private. Update aiohttp to version 3.13.4 or later to stop the unintended sharing of those headers.
What to do
- Update aiohttp team aiohttp to version 3.13.4.
- Update aiohttp team aiohttp to version 3.9.3+aikido.8.
- Update rootio-aiohttp to version 3.9.3+root.io.8.
- Update rootio-aiohttp to version 3.10.11+root.io.6.
- Update aiohttp team aiohttp to version 3.10.11+aikido.6.
- Update aiohttp team aiohttp to version 3.10.11+aikido.7.
- Update rootio-aiohttp to version 3.12.14+root.io.3.
- Update rootio-aiohttp to version 3.12.15+root.io.6.
- Update rootio-aiohttp to version 3.13.3+root.io.11.
- Update rootio-aiohttp to version 3.12.14+root.io.5.
- Update rootio-aiohttp to version 3.8.6+root.io.5.
- Update rootio-aiohttp to version 3.8.6+root.io.7.
- Update rootio-aiohttp to version 3.8.6+root.io.8.
- Update rootio-aiohttp to version 3.8.6+root.io.9.
- Update rootio-aiohttp to version 3.13.3+root.io.12.
- Update aiohttp team aiohttp to version 3.8.6+aikido.11.
- Update aiohttp team aiohttp to version 3.8.6+aikido.12.
- Update aiohttp team aiohttp to version 3.12.15+aikido.8.
- Update aiohttp team aiohttp to version 3.12.14+aikido.7.
- Update aiohttp to version 3.8.6+aikido.14.
- Update aiohttp to version 3.12.14+aikido.9.
- Update aiohttp to version 3.13.3+aikido.16.
- Update aiohttp aiohttp to version 3.13.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | aiohttp team | aiohttp |
<= 3.13.3 Fix: upgrade to 3.13.4
|
| PyPI | aiohttp team | aiohttp |
< 3.13.4 Fix: upgrade to 3.13.4
|
| – | aiohttp | aiohttp |
< 3.13.4 cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* |
| Debian:11 | debian | python-aiohttp | All versions |
| Debian:12 | debian | python-aiohttp | All versions |
| Debian:13 | debian | python-aiohttp | All versions |
| Debian:14 | debian | python-aiohttp | All versions |
| Root:PyPI | aiohttp team | aiohttp |
< 3.9.3+aikido.8 < 3.10.11+aikido.6 < 3.10.11+aikido.7 < 3.8.6+aikido.11 < 3.8.6+aikido.12 < 3.12.15+aikido.8 < 3.12.14+aikido.7 Fix: upgrade to 3.9.3+aikido.8
|
| Root:PyPI | – | rootio-aiohttp |
< 3.9.3+root.io.8 < 3.10.11+root.io.6 < 3.12.14+root.io.3 < 3.12.15+root.io.6 < 3.13.3+root.io.11 < 3.12.14+root.io.5 < 3.8.6+root.io.5 < 3.8.6+root.io.7 < 3.8.6+root.io.8 < 3.8.6+root.io.9 < 3.13.3+root.io.12 Fix: upgrade to 3.9.3+root.io.8
|
| Ubuntu:Pro:16.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | python-aiohttp | All versions |
| Ubuntu:25.10 | canonical | python-aiohttp | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | python-aiohttp | All versions |
| Root:PyPI | – | aiohttp |
< 3.8.6+aikido.14 < 3.12.14+aikido.9 < 3.13.3+aikido.16 Fix: upgrade to 3.8.6+aikido.14
|
Original advisory text
AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.
References
- https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24f... Patch
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 Release Notes
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9 Patch Vendor Advisory
- https://github.com/advisories/GHSA-966j-vmvw-g2g9
- https://github.com/aio-libs/aiohttp Product
- https://security-tracker.debian.org/tracker/CVE-2026-34518 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-34518 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-34518 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34518... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34518 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published1 Apr 2026
Updated4 Nov 2026
First seen1 Apr 2026
Sources
CVE-2026-34518 · NVD
GHSA-966j-vmvw-g2g9 · GHSA
GHSA-966j-vmvw-g2g9 · OSV
CVE-2026-34518 · OSV
DEBIAN-CVE-2026-34518 · OSV
UBUNTU-CVE-2026-34518 · OSV
Track software like this
Free during beta