VulnSocial

CVE-2026-47265General(aiohttp / aiohttp)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch aiohttp aiohttp systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

aiohttp CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • aiohttp

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-06-02); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
aiohttp
Products
aiohttp

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-02: 1Mentions · 2026-06-04: 1Mentions · 2026-07-23: 1Patch / Workaround · 2026-07-23: 1Technical Details · 2026-06-02: 1Technical Details · 2026-06-04: 1Technical Details · 2026-07-23: 106-0206-0407-23
Signal classification2 categories
General
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-021
General1
2026-06-041
General1
2026-07-231
Patch1
Full discourse3 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH Severity: CVE-2026-47265 (CVSS 7.5) AIOHTTP <3.14.0 leaks cookies after cross-origin redirects. Sensitive data exposure risk. Mitigation: Upgrade to 3.14.0 or use Cookie header instead of cookies parameter. #CVE #Vulnerability #PatchNow https://t.co/dIuYGw5IMU

    Post summary

    The tweet reports CVE-2026-47265 as a high severity flaw that leaks cookies after cross-origin redirects and advises upgrading to version 3.14.0 or using the Cookie header as a mitigation.

    0000040
    91 followersView on X
  • DailyCVE@dailycve
    General

    🟠 AIOHTTP, Cross-Origin Redirect with Per-Request Cookies, #CVE-2026-47265 (Moderate) -DC-Jun2026-201 https://dailycve.com/aiohttp-cross-origin-redirect-with-per-request-cookies-cve-2026-47265-moderate-dc-jun2026-201/

    Post summary

    The entry announces CVE-2026-47265 as a moderate severity cross-origin redirect vulnerability in AIOHTTP, providing a technical description but no evidence of exploits, patches, or active misuse.

    0000038
    208 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-47265 Cookie Leakage Across Cross-Origin Redirects in AIOHTTP Before 3.14.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47265

    Post summary

    The snippet merely announces CVE‑2026‑47265 as a cookie leakage issue in AIOHTTP prior to version 3.14.0, offering no details on exploitation, mitigation, or proof-of‑concept.

    0000061
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appaiohttpaiohttp---

Explore more

Back to dashboardaiohttp CVEsaiohttp vulnerabilities