CVE-2026-34518: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

April 1, 2026 (updated April 24, 2026)

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.

References

github.com/advisories/GHSA-966j-vmvw-g2g9
github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6
github.com/aio-libs/aiohttp/releases/tag/v3.13.4
github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9
nvd.nist.gov/vuln/detail/CVE-2026-34518

Code Behaviors & Features

Detect and mitigate CVE-2026-34518 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →