Skip to content

GHSA-hg6j-4rv6-33pg on CTRL-OS 26.05

Aliases: GHSA-hg6j-4rv6-33pg, CVE-2026-47265

Packages: python3Packages.aiohttp

Status: Plausible

Advisory Information

Summary

Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.

Impact

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.

Workaround

If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.

Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478

Updates

2026-07-10 22:13 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “Plausible”

(Amended on: 2026-07-10 22:14 CEST)

2026-07-10 20:35 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “New”