GitHub Advisoryadvisory · PyPI

GHSA-966j-vmvw-g2g9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

LOW Published 2026-04-01 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-34518
Ecosystem
PyPI
Packages
aiohttp
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-04-01

Affected packages

• PyPI aiohttp: < 3.13.4 → fixed in 3.13.4

Description

Summary When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. Impact The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect. ----- Patch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6

Related

Alias · CVE (1)

  • CVE-2026-34518 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References