CVE-2026-34518: AIOHTTP Cookie and Proxy-Authorization Header Leak on Cross-Origin Redirects
Summary
CVE-2026-34518: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect. Affects aiohttp versions < 3.13.4. Fixed in 3.13.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle both client and server-side web applications. It provides a simple interface for making HTTP requests and handling responses, making it a go-to choice for developers building web applications. However, a recent vulnerability has been identified that affects how AIOHTTP manages sensitive headers during cross-origin redirects, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from AIOHTTP's handling of HTTP redirects to different origins. While it correctly drops the Authorization header, it inadvertently retains the Cookie and Proxy-Authorization headers. This oversight can lead to sensitive information being leaked to unintended parties when a redirect occurs, posing a security risk to applications that rely on AIOHTTP for HTTP requests.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.4
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually strip the Cookie and Proxy-Authorization headers before making requests that may follow redirects to different origins. This can be done by modifying your request code to exclude these headers when necessary.
Conclusion
The CVE-2026-34518 vulnerability in AIOHTTP poses a risk of leaking sensitive information through Cookie and Proxy-Authorization headers during cross-origin redirects. It is crucial for developers using AIOHTTP to update to the latest version to safeguard their applications against potential data exposure.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2026-34518 is a vulnerability in the AIOHTTP library that allows sensitive Cookie and Proxy-Authorization headers to be leaked during cross-origin redirects.
If your application uses AIOHTTP and follows redirects to different origins, sensitive information in the Cookie and Proxy-Authorization headers may be exposed to unintended parties.
You should update to version 3.13.4 or later as soon as possible to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground without any signup.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
