---
schema_version: '1.0'
id: security-20260714-ce4cf5
url: https://osv.dev/vulnerability/PYSEC-2026-2105
url_hash: ce4cf5aa9e560f335f331f6995ada960536210d14c403a17e8031604cdc91093
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2105
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-47265
- PYSEC-2026-2105
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- aiohttp
- PyPI
lang: en
published_at: '2026-06-02T20:16:37Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: a5a56e89b37c3a17c95b60cda607455a88e000a736eef855817f98b636a29914
license_note: full
summary: 'AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests
  are sent after following a cross-origin redirect. If a developer uses the `cookies`
  parameter on a per-request basis then '
summary_source: rss
summary_en: 'AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests
  are sent after following a cross-origin redirect. If a developer uses the `cookies`
  parameter on a per-request basis then '
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-47265 — aiohttp
---

# CVE-2026-47265 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then 

## Key Points
- cve / CVE-2026-47265 / PYSEC-2026-2105 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
**Advisory:** PYSEC-2026-2105 (CVE-2026-47265)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.0 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

**References:**
- https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2105_

## Source
元記事: [CVE-2026-47265 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2105) — published 2026-06-02T20:16:37Z