CVE-2026-47265: Aiohttp

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

Affected products

• Aiohttp Aiohttp: before 3.14.0 (fixed in 3.14.0)

Published 2026-06-02. Last modified 2026-07-21.