CVE-2026-34518: Aiohttp

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

Affected products

• Aiohttp Aiohttp: before 3.13.4 (fixed in 3.13.4)

Published 2026-04-01. Last modified 2026-06-17.