{"id":"CVE-2026-34518","aliases":["ALPINE-CVE-2026-34518","AZL-81773","CLSA-2026-1780361391","CLSA-2026-1780447823","CLSA-2026-1780447825","CLSA-2026-1780447826","DEBIAN-CVE-2026-34518","EUVD-2026-18042","GHSA-966j-vmvw-g2g9","OESA-2026-2192","OESA-2026-2193","OESA-2026-2194","PYSEC-2026-2100","SUSE-SU-2026:22173-1","SUSE-SU-2026:3059-1","SUSE-SU-2026:3207-1","UBUNTU-CVE-2026-34518","openSUSE-SU-2026:21098-1"],"status":"published","title":"AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-04-01T20:15:22Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.13.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-aiohttp","fixed_in":["3.13.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-aiohttp","fixed_in":["3.13.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-aiohttp","fixed_in":["3.8.4-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiohttp","fixed_in":["3.13.5-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.13.3"},{"fixed":"3.13.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.4"},{"fixed":"3.8.4.post4+tuxcare"}]}],"versions":["3.8.4","3.8.4.post1+tuxcare","3.8.4.post2+tuxcare","3.8.4.post3+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1.post10+tuxcare"}]}],"versions":["3.8.1","3.8.1.post1+tuxcare","3.8.1.post2+tuxcare","3.8.1.post3+tuxcare","3.8.1.post4+tuxcare","3.8.1.post5+tuxcare","3.8.1.post6+tuxcare","3.8.1.post7+tuxcare","3.8.1.post8+tuxcare","3.8.1.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.8.5.post8+tuxcare"}]}],"versions":["3.8.5","3.8.5.post1+tuxcare","3.8.5.post2+tuxcare","3.8.5.post3+tuxcare","3.8.5.post4+tuxcare","3.8.5.post5+tuxcare","3.8.5.post6+tuxcare","3.8.5.post7+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.6"},{"fixed":"3.8.6.post5+tuxcare"}]}],"versions":["3.8.6","3.8.6.post1+tuxcare","3.8.6.post2+tuxcare","3.8.6.post3+tuxcare","3.8.6.post4+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u2"}]}],"versions":["3.8.4-1","3.8.4-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.11.16-1+deb13u1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1","3.14.0-1","3.14.1-1","3.14.1-2","3.14.1-3","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-1"}]}],"versions":["3.11.16-1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3"]},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.13.3","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-1.oe2403sp1"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-1.oe2403sp3"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-1.oe2403"}]}],"bundled":9},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.13.3","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.5.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.5.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.35.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.35.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.35.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.35.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1","0.17.4-1","0.17.4-1build1","0.20.2-1","0.20.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4","3.0.1-1ubuntu0.1~esm5","3.0.1-1ubuntu0.1~esm6","3.0.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.4-1","3.5.4-1build1","3.6.1-1","3.6.2-1","3.6.2-1build1","3.6.2-1ubuntu0.1~esm1","3.6.2-1ubuntu1","3.6.2-1ubuntu1+esm1","3.6.2-1ubuntu1+esm3","3.6.2-1ubuntu1+esm4","3.6.2-1ubuntu1+esm5","3.6.2-1ubuntu1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2","3.8.1-4ubuntu0.2+esm1","3.8.1-4ubuntu0.2+esm2","3.8.1-4ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1","3.9.1-1ubuntu0.1+esm1","3.9.1-1ubuntu0.1+esm2","3.9.1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.11-1build1","3.11.16-1","3.11.16-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.3-3ubuntu1","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.13.1-1","3.13.3-3","3.13.3-3ubuntu1","3.13.3-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.5.1"}]}],"bundled":11}],"products":[{"vendor":"aio-libs","product":"aiohttp"},{"vendor":"aiohttp","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","fix","report"]},{"url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4","tags":["x_refsource_MISC","Release Notes","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-966j-vmvw-g2g9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34518","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34518.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34518","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2193","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2194","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261320","tags":["report"]},{"url":"https://bugzilla.suse.com/1261321","tags":["report"]},{"url":"https://bugzilla.suse.com/1261322","tags":["report"]},{"url":"https://bugzilla.suse.com/1261329","tags":["report"]},{"url":"https://bugzilla.suse.com/1261331","tags":["report"]},{"url":"https://bugzilla.suse.com/1261332","tags":["report"]},{"url":"https://bugzilla.suse.com/1261334","tags":["report"]},{"url":"https://bugzilla.suse.com/1261335","tags":["report"]},{"url":"https://bugzilla.suse.com/1261343","tags":["report"]},{"url":"https://bugzilla.suse.com/1267471","tags":["report"]},{"url":"https://bugzilla.suse.com/1267561","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47265","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263059-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268398","tags":["report"]},{"url":"https://bugzilla.suse.com/1268543","tags":["report"]},{"url":"https://bugzilla.suse.com/1268544","tags":["report"]},{"url":"https://bugzilla.suse.com/1268549","tags":["report"]},{"url":"https://bugzilla.suse.com/1268556","tags":["report"]},{"url":"https://bugzilla.suse.com/1268559","tags":["report"]},{"url":"https://bugzilla.suse.com/1268560","tags":["report"]},{"url":"https://bugzilla.suse.com/1268561","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54280","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34518","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34518","title":"AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T20:15:22.426Z","modified":"2026-04-02T14:06:07.93Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-18042","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T20:15:22Z","modified":"2026-04-02T14:06:07Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T19:25:23.121433Z"}],"ghsa":[{"id":"GHSA-966j-vmvw-g2g9","title":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","description":"### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","status":"published","published":"2026-04-01T21:47:46Z","modified":"2026-04-24T20:33:20Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:56.453138Z"}],"nvd":[{"id":"CVE-2026-34518","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00.02Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"ALPINE-CVE-2026-34518","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00.02Z","modified":"2026-11-03T06:33:02.415867813Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-34518","title":"AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T20:15:22.426Z","modified":"2026-10-28T02:31:08.459113801Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34518","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00.02Z","modified":"2026-11-01T00:00:12.62401412Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-966j-vmvw-g2g9","title":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","description":"### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","status":"published","published":"2026-04-01T21:47:46Z","modified":"2026-09-10T03:51:01.374434696Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"OESA-2026-2192","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)\n\nAn attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)\n\naiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)\n\nThe llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)\n\naiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:50.914544192Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2193","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)\n\nAn attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)\n\naiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)\n\nThe llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)\n\naiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:51.146135035Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2194","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)\n\nAn attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)\n\naiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)\n\nThe llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)\n\naiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:51.790459172Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-2100","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00.02Z","modified":"2026-07-13T07:15:20.558859332Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-34518","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00Z","modified":"2026-10-17T13:00:01.577408343Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81773","title":"CVE-2026-34518 affecting package python-aiohttp 3.6.2-3","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.","status":"published","published":"2026-04-01T21:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1780361391","title":"TuxCare security update for aiohttp (4 CVEs)","description":"TuxCare rebuilt aiohttp to address 4 CVEs. Fixed in 3.8.4.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:01.239829706Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780447823","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post10+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:00.994298366Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780447825","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.5.post8+tuxcare.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:48:01.171413407Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780447826","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post5+tuxcare.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:48:01.199975198Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:21098-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).\n- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).\n- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).\n- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure\n  (bsc#1261332).\n- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).\n- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect\n  (bsc#1267561).\n","status":"published","published":"2026-06-19T08:00:07Z","modified":"2026-06-30T18:24:40.80055349Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22173-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).\n- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).\n- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).\n- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure\n  (bsc#1261332).\n- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).\n- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect\n  (bsc#1267561).\n","status":"published","published":"2026-06-19T07:54:42Z","modified":"2026-06-24T18:24:18.210804302Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:3059-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).\n- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).\n- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).\n- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).\n- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).\n- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect (bsc#1267561).\n","status":"published","published":"2026-07-15T13:34:42Z","modified":"2026-07-16T10:00:16.322535434Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3207-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of\n  service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).\n- CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).\n- CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of\n  service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service\n  (bsc#1261331).\n- CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information\n  disclosure (bsc#1261332).\n- CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343).\n- CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect\n  and can leak sensitive data (bsc#1267561).\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n","status":"published","published":"2026-07-23T14:10:50Z","modified":"2026-07-24T17:16:06.381467415Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}