Every CVE Search/ Get API key

CVE-2026-47265

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

6.6 MediumFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.15%Up 0.1 points since Jun 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.6

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
CVE-2026-47265
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-346
Updated
2026-11-02
EUVDEUVD-2026-34007 6.6

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
EUVD-2026-34007
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-hg6j-4rv6-33pg 6.6

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

Summary

Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.

Impact

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.

Workaround

If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478

Record
GHSA-hg6j-4rv6-33pg
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-346
Updated
2026-11-02
NVD 6.6

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
CVE-2026-47265
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-346
Updated
2026-11-02
OSV 6.6

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
CVE-2026-47265
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-346
Updated
2026-11-02
OSVDEBIAN-CVE-2026-47265 7.5

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
DEBIAN-CVE-2026-47265
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 15 moreShow less
OSVGHSA-hg6j-4rv6-33pg 6.6

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

Summary

Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.

Impact

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.

Workaround

If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478

Record
GHSA-hg6j-4rv6-33pg
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-346
Updated
2026-11-02
OSVOESA-2026-2562 6.6

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.(CVE-2026-34993)

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.(CVE-2026-47265)

Record
OESA-2026-2562
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2563 6.6

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.(CVE-2026-34993)

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.(CVE-2026-47265)

Record
OESA-2026-2563
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVPYSEC-2026-2105 7.5

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
PYSEC-2026-2105
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-47265 6.6

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
UBUNTU-CVE-2026-47265
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-89333 No score

CVE-2026-47265 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Record
AZL-89333
Updated
2026-11-05
OSVCLSA-2026-1781830554 No score

TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post6+tuxcare.

Record
CLSA-2026-1781830554
Updated
2026-11-02
OSVCLSA-2026-1784769517 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post5+tuxcare.

Record
CLSA-2026-1784769517
Updated
2026-11-02
OSVCLSA-2026-1787723258 No score

TuxCare security update for aiohttp (3 CVEs)

TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.5.post10+tuxcare.

Record
CLSA-2026-1787723258
Updated
2026-11-02
OSVCLSA-2026-1791377424 No score

TuxCare security update for aiohttp (7 CVEs)

TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.1.post16+tuxcare.

Record
CLSA-2026-1791377424
Updated
2026-11-02
OSVopenSUSE-SU-2026:21098-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
openSUSE-SU-2026:21098-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-47265 No score

CVE-2026-47265 in aiohttp - Patched by Root

Root has patched CVE-2026-47265 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-47265
Updated
2026-11-02
OSVSUSE-SU-2026:22173-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
SUSE-SU-2026:22173-1
Updated
2026-11-02
OSVSUSE-SU-2026:3059-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
SUSE-SU-2026:3059-1
Updated
2026-11-02
OSVSUSE-SU-2026:3207-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header injection (bsc#1261322).
  • CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers when following redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: response reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers allow for potential security bypass in proxy servers (bsc#1261343).
  • CVE-2026-34993: loading untrusted input in CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561).
  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
SUSE-SU-2026:3207-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 before 3.14.0
3.14.0
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
 3.8.6 up to 3.8.6.post6+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare
3.8.6.post6+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.4 up to 3.8.4.post5+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare
3.8.4.post5+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 3 CVEs
 3.8.5 up to 3.8.5.post10+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare
Show 4 moreShow less
3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post10+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 7 CVEs
 3.8.1 up to 3.8.1.post16+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post13+tuxcare
Show 10 moreShow less
3.8.1.post14+tuxcare3.8.1.post15+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare
3.8.1.post16+tuxcare
python-aiohttp
Debian:12
 before 3.8.4-1+deb12u2, plus listed versions
3.8.4-13.8.4-1+deb12u1
3.8.4-1+deb12u2
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 before 3.14.0-1, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-13.13.3-23.13.3-33.13.5-1
3.14.0-1
aiohttp
PyPI
 before 3.14.0, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.14.0
Show 30 moreShow less
Affected packages
PackageAffectedFixed
python-aiohttp
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.14.0-1.oe2403sp1
3.14.0-1.oe2403sp1
python-aiohttp
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.14.0-1.oe2403sp3
3.14.0-1.oe2403sp3
aiohttp
Root:PyPI
 before 3.8.6+aikido.1
3.8.6+aikido.13.12.14+aikido.23.10.11+aikido.53.12.15+aikido.33.10.11+aikido.63.10.11+aikido.73.13.5+aikido.13.12.14+aikido.33.12.15+aikido.43.12.15+aikido.53.12.15+aikido.63.8.6+aikido.23.8.6+aikido.33.10.11+aikido.83.12.14+aikido.43.13.5+aikido.23.13.4+aikido.13.13.3+aikido.113.13.4+aikido.23.8.6+aikido.43.12.14+aikido.53.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.13.5+aikido.33.8.6+aikido.103.13.3+aikido.123.13.4+aikido.33.10.11+aikido.93.13.3+aikido.133.13.4+aikido.43.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.9.5+aikido.33.9.5+aikido.43.13.5+aikido.43.8.6+aikido.133.9.5+aikido.53.13.3+aikido.143.12.14+aikido.83.13.4+aikido.53.12.15+aikido.73.10.11+aikido.103.9.5+aikido.63.13.3+aikido.153.13.4+aikido.63.12.15+aikido.83.13.5+aikido.53.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.9.5+aikido.73.12.15+aikido.93.12.14+aikido.93.13.5+aikido.63.13.3+aikido.163.13.4+aikido.73.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:25.10
 All versions, plus listed versions
3.10.11-1build13.11.16-13.11.16-1ubuntu0.1
 None known
python-aiohttp
Ubuntu:26.10
 All versions, plus listed versions
3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47265 is a medium vulnerability (CVSS 6.6) in Aio-libs Aiohttp, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in aiohttp 3.14.0.

References

Show 47 moreShow less
This page doesn't list everything

Left out here: 256 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open