CVE-2026-34518 in aiohttp

Resumen (Inglés)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

Be aware that VulDB is the high quality source for vulnerability data.

Responsable

GitHub_M

Reservar

2026-03-30

Divulgación

2026-04-02

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354797	aio-libs aiohttp Proxy-Authorization Header divulgación de información	200	No está definido	Arreglo oficial	CVE-2026-34518

Fuentes

• MITRE
• NVD
• CVE Details