CVE-2026-47265: aio-libs aiohttp Origin Validation Error
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-hg6j-4rv6-33pgPYSEC-2026-2105UBUNTU-CVE-2026-47265DEBIAN-CVE-2026-47265CGA-3cxv-m236-f49xCGA-3g26-vc47-8hp5CGA-7hqf-w9x5-75hvCGA-h6wh-687x-jfgmCGA-h944-cj3g-2h66CGA-qphj-vq4h-j73pCGA-r8x9-c35j-vxmrCGA-r998-c8ch-g3phCGA-vm5x-m66c-4gw8CGA-24r5-vf49-fffpCGA-2jxf-jqjw-64hgCGA-2p7h-577r-mwr5CGA-2v4q-r7v5-7vj6CGA-2v9x-fxq4-m6hwCGA-2vfr-cfc8-g8q6CGA-2vwf-g7g4-gmw5CGA-2w34-f867-v56wCGA-32xm-mw7r-7fpxCGA-389x-w746-cq5wCGA-3cp4-44j4-r39gCGA-3jf9-wh3r-2v49CGA-3pr9-m24f-7r76CGA-425r-rv59-373rCGA-46xc-3c99-g2rcCGA-4j2w-mv36-xf27CGA-59c8-c85g-vmhhCGA-6463-m2g9-jhm6CGA-68hx-px3g-hfx3CGA-6942-2cf7-g389CGA-6r6p-h449-rvcgCGA-6w45-7xqw-pr7qCGA-7ghr-qv76-55w5CGA-7v4f-jvv3-39qrCGA-8m9r-j644-6v63CGA-9h85-hg2j-9c4gCGA-9v8r-3h5f-7mg2CGA-c2g4-2q7g-69hjCGA-gmqf-xh2w-pjc3CGA-h3q3-8372-wr96CGA-h3x5-w975-53jjCGA-hpjq-h8f9-9j7vCGA-j45w-gm29-vjmvCGA-jq77-fxh2-g9q3CGA-m862-w29x-47cwCGA-pcfh-h86q-p527CGA-pm3r-jcx9-j7qgCGA-pqx9-pgmc-mj7gCGA-pvpm-mrh3-8vj3CGA-qqxv-2hpw-3c73CGA-qwv6-p98r-v2fjCGA-r387-6p52-3r3hCGA-r4qp-v2mr-2c74CGA-r5pw-3pg7-hrjwCGA-rhqc-q8gc-f62wCGA-rhv3-2c89-82fhCGA-rjcm-5q6m-jfg3CGA-rwq6-258v-875rCGA-v37h-p25r-27fqCGA-vc3r-rqhh-w5j9CGA-vrjm-xjrh-7r4rCGA-wxhx-56pf-j6w7CGA-x8pp-rcr6-2f98CGA-xcxq-6m9g-3pq9
Published 02-06-2026Last modified 03-06-2026
Vulnerability summary
CVE-2026-47265 is a high (CVSS 7.5) Origin Validation Error vulnerability in aio-libs aiohttp. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.21%
0%100%
Low · +0.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 03-06-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:USources5 sources · 6.6–8.7
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.06 pp
From 0.15% on 20-09-2026
20-09-202620-10-2026
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard37 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.2-r1
- airflow-core-2< 2.11.2-r6
- awx< 24.6.1-r38
- checkov< 3.2.533-r1
Wolfi5 products
- airflow-3< 3.2.2-r1
- checkov< 3.2.533-r1
- dask-kubernetes< 2026.3.0-r6
- katib-earlystopping< 0.19.0-r18
- open-webui< 0.9.6-r3
Aio-libs1 product
- aiohttp< 3.14.0
Aiohttp1 product
- aiohttp< 3.14.0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.14.0-1
PyPI1 product
- aiohttp< 3.14.0
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
7 vendors · 47 products
References
8 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pgX Refsource CONFIRMWEBFIXAdvisoryMitigationPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478X Refsource MISCWEBFIXPatch
- github.com/aio-libs/aiohttpPACKAGE
