CVE-2026-34518: AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
Analyzed
AliasesGHSA-966j-vmvw-g2g9PYSEC-2026-2100UBUNTU-CVE-2026-34518DEBIAN-CVE-2026-34518CGA-32h2-pq65-vhwqCGA-4727-x5w8-xwvgCGA-47cc-3fr4-vxhpCGA-5233-hwh4-mwjfCGA-5mx9-58x2-j54cCGA-8jv9-p2jc-33r6CGA-95w3-6rvc-353wCGA-9g9p-xw3x-rpmjCGA-c4gc-gmjp-jm6qCGA-f984-cxm7-vpq2CGA-gfcj-g5fm-vxvqCGA-hq2g-hh25-2p8jCGA-p694-3q8p-chm7CGA-rhwq-7w6j-55c7CGA-v4v7-2p8r-cjqpCGA-xc6p-h6f8-f46rCGA-xw7j-f7ff-7hx7CGA-22rq-w2p5-vc98CGA-2349-pqc3-fg25CGA-2c7h-3394-88pvCGA-2cjm-qfxc-h95hCGA-2q34-q9wq-x3jwCGA-3ch9-cg4x-2496CGA-4cr3-m5jg-c3j5CGA-4j45-672j-46jmCGA-696h-8h5x-pr9fCGA-7jrp-2rhr-3fr6CGA-7vh9-7rvj-v327CGA-c48w-xf95-7962CGA-c5jg-7hg7-3r4vCGA-c87f-6xpx-qxcjCGA-f424-3jh8-fprpCGA-f8rc-2q7v-89vpCGA-f9j7-x5wj-hr5hCGA-g54v-q2jp-jvfcCGA-gqmc-wj8r-vvm6CGA-h26x-869m-w6r8CGA-h2w2-67fh-v9pwCGA-h3mx-qgmj-qgm7CGA-j3c8-9ww5-wqprCGA-jgxg-f5cr-24c5CGA-mj73-69mv-pphqCGA-pm59-rgcp-38wrCGA-prg8-3fvx-84jpCGA-q23g-3wpf-2rj6CGA-q3g7-v454-r2ppCGA-q4wh-mfgh-q4r7CGA-qvc6-5282-6gm2CGA-r52v-vwq4-59x8CGA-v8gg-q537-9cc9CGA-vf52-592c-x7xqCGA-vh8x-rgfp-gfw6CGA-w93x-hv22-935qCGA-wf9r-48wq-245pCGA-wp9f-97r2-5h98CGA-wrhc-rrqx-qmjxCGA-wv7f-qxwc-4xxqCGA-x3jq-hrw9-f439CGA-xpf8-9jxp-3xh6CGA-xv68-99gc-j5rwALPINE-CVE-2026-34518
Published 01-04-2026Last modified 02-04-2026
Vulnerability summary
CVE-2026-34518 is a medium (CVSS 5.3) vulnerability in aio-libs aiohttp. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.6% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 2.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.35%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.
CVSS metrics
10 scores · 8 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:USources5 sources · 2.7–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.40% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Alpine1 product
- py3-aiohttp< 3.13.5-r0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.13.5-1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
8 vendors · 39 products
References
10 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9X Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6X Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
