Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2026-34518

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

aio-libs aiohttp

  • < 3.13.4affected

References