CVE-2026-47265

Publication date 2 June 2026

Last updated 18 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-aiohttp	26.04 LTS resolute	Needs evaluation
	25.10 questing	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation

Severity score breakdown

CVSS version:

Base score 6.6 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	High
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	None
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	6.6 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Base score 7.5 · High