CVE-2026-47265
Fixed in a distro release EPSS <1%CVSS 6.6
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-3 | 3.2.2-r1 |
| Chainguard | airflow-core-2 | 2.11.2-r6 |
| Chainguard | awx | 24.6.1-r38 |
| Chainguard | checkov | 3.2.533-r1 |
| Chainguard | dagster | 1.13.8-r0 |
| Chainguard | dagster-fips | 1.13.8-r0 |
| Chainguard | dask-kubernetes | 2026.3.0-r6 |
| Chainguard | dask-kubernetes-fips | 2026.3.0-r3 |
| Chainguard | datahub-ingestion | 1.6.0-r2 |
| Chainguard | datahub-ingestion-fips | 1.6.0-r1 |
| Chainguard | gitlab-toolbox-ce-18.10 | 18.10.7-r1 |
| Chainguard | gitlab-toolbox-ce-18.11 | 18.11.4-r2 |
| Chainguard | gitlab-toolbox-ce-fips-18.10 | 18.10.7-r2 |
| Chainguard | gitlab-toolbox-ce-fips-18.11 | 18.11.4-r2 |
| Chainguard | katib-earlystopping | 0.19.0-r18 |
| Chainguard | keep-api | 0.52.1-r1 |
| Chainguard | keep-api | 0.53.0-r0 |
| Chainguard | keep-api-fips | 0.52.1-r2 |
| Chainguard | litellm | 1.87.1-r1 |
| Chainguard | lmcache-cuda-12.8 | 0.4.6-r0 |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | nemo | 2.7.3-r6 |
| Chainguard | opal | 0.9.6-r1 |
| Chainguard | open-webui | 0.9.6-r3 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.18.1-r3 |
| Chainguard | py3.10-vllm-cuda-12.9 | 0.19.1-r0 |
| Chainguard | py3.10-vllm-cuda-13.0 | 0.20.2-r1 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.18.1-r3 |
| Chainguard | py3.12-vllm-cuda-12.9 | 0.19.1-r0 |
| Chainguard | py3.12-vllm-cuda-13.0 | 0.20.2-r1 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r3 |
| Chainguard | py3.13-vllm-cuda-12.9 | 0.19.1-r0 |
| Chainguard | py3.13-vllm-cuda-13.0 | 0.20.2-r1 |
| Chainguard | request-1276 | 0.29.0-r0 |
| Chainguard | text-generation-inference | 3.3.7-r14 |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | 25.9.0_git20260617-r2 |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | 25.9.0_git20260617-r0 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r8 |
| Chainguard | vllm-cuda-13.2 | 0.21.0-r1 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | no fix |
| Debian 14 | python-aiohttp | 3.14.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.35.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.35.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.35.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP7 | python-aiohttp | 3.6.0-150100.3.35.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server 16.0 | python-aiohttp | 3.11.16-160000.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-aiohttp | 3.9.3-150400.10.43.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-aiohttp | 3.11.16-160000.5.1 |
| Ubuntu 25.10 | python-aiohttp | no fix |
| Ubuntu 26.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 22.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 24.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | airflow-3 | 3.2.2-r1 |
| Wolfi | checkov | 3.2.533-r1 |
| Wolfi | dask-kubernetes | 2026.3.0-r6 |
| Wolfi | katib-earlystopping | 0.19.0-r18 |
| Wolfi | open-webui | 0.9.6-r3 |
| openSUSE Leap 16.0 | python-aiohttp | 3.11.16-160000.5.1 |