Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-966j-vmvw-g2g9

Опубликовано: 01 апр. 2026
Источник: github
Github: Прошло ревью
CVSS4: 2.7
CVSS3: 5.3

Описание

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Summary

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.

Impact

The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.


Patch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6

Пакеты

Наименование

aiohttp

pip
Затронутые версииВерсия исправления

<= 3.13.3

3.13.4

EPSS

Процентиль: 26%
0.00337
Низкий

2.7 Low

CVSS4

5.3 Medium

CVSS3

Дефекты

CWE-200

Связанные уязвимости

CVSS3: 5.3
ubuntu
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS3: 3.7
redhat
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS3: 5.3
nvd
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS3: 5.3
debian
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...

CVSS3: 5.3
fstec
5 месяцев назад

Уязвимость HTTP-клиента aiohttp, связанная с недостаточной защитой служебных данных, позволяющая нарушителю раскрыть защищаемую информацию

EPSS

Процентиль: 26%
0.00337
Низкий

2.7 Low

CVSS4

5.3 Medium

CVSS3

Дефекты

CWE-200