VDB

CVE-2026-47265

CVE-2026-47265 PUBLISHED CVSS 6.6 MEDIUM

Reported by GitHub_M · Published June 2, 2026

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

Risk Scores

CVSS 4.0
6.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Affected Products

VendorProductVersions
aio-libsaiohttp< 3.14.0
chainguardgitlab-cng-18.100, 0, 0
chainguarddatahub-ingestion-fips0, 0, 0
alpinepy3-aiohttp0, 0, 0
chainguardairflow-30, 0, 0
chainguardpy3-vllm-cuda-12.40, 0, 0
chainguarddask-kubernetes-fips0, 0, 0
chainguardgitlab-cng-fips-18.110, 0, 0
chainguardpy3-vllm-cuda-13.00, 0, 0
chainguardcheckov0, 0, 0
wolfiairflow-30, 0, 0
aio-libsaiohttp< 3.14.0, < 3.14.0, < 3.14.0
wolfikubeflow-katib0, 0, 0
chainguardgitlab-cng-18.110, 0, 0
chainguarddask-kubernetes0, 0, 0
chainguardgitlab-cng-fips-18.100, 0, 0
chainguardrequest-12760, 0, 0
chainguardawx0, 0, 0
chainguardtritonserver-backend-vllm-cuda-12.90, 0, 0
chainguardairflow-core-20, 0, 0

…and 20 more

Timeline

  • Jun 2, 2026 CVE Published
  • Jun 3, 2026 CVE Updated
  • Jun 4, 2026 Coalition ESS Score
  • Jun 5, 2026 EPSS Score
  • Jun 5, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›