Is there a patch available for CVE-2026-34518?

Yes, a patch is available for CVE-2026-34518. Update the affected software to the latest version immediately.

Python CVE-2026-34518

Q: What is the CVSS score of CVE-2026-34518?

CVE-2026-34518 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18042 LOW

Information Exposure (CWE-200)

2026-04-01 GitHub_M

GHSA-966j-vmvw-g2g9

Python Information Disclosure

2.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18042

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:15 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

122 pypi packages depend on aiohttp (43 direct, 79 indirect)

Ecosystem-wide dependent count for version 3.13.4.

DescriptionGitHub Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

AnalysisAI

AIOHTTP prior to version 3.13.4 leaks sensitive authentication credentials across origin boundaries during HTTP redirects by failing to drop Cookie and Proxy-Authorization headers while inconsistently removing the Authorization header. This information disclosure vulnerability affects all Python applications using vulnerable AIOHTTP versions when following cross-origin redirects, potentially exposing session tokens and proxy credentials to untrusted origins. No public exploit code or active exploitation has been identified, and the EPSS score of 2.7 indicates low exploitation probability despite the low CVSS score reflecting confidentiality impact.

Technical ContextAI

AIOHTTP is a Python asynchronous HTTP framework built on asyncio. The vulnerability stems from improper header filtering (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the redirect-following logic. When a client receives an HTTP 3xx redirect response pointing to a different origin, the framework should apply origin-based security filtering by removing all credentials and sensitive headers. Instead, AIOHTTP inconsistently handles this: it drops the Authorization header (which contains Bearer tokens and Basic auth credentials) but fails to strip Cookie headers (session tokens) and Proxy-Authorization headers (proxy credentials). An attacker controlling a destination domain can set up a redirect from a legitimate service (e.g., trusted-domain.com/resource → attacker.com/endpoint) to harvest these headers when client applications follow the redirect. The CPE cpe:2.3:a:aio-libs:aiohttp:*:*:*:*:*:*:*:* indicates all versions before the patch are affected.

RemediationAI

Vendor-released patch: AIOHTTP 3.13.4 and later. Upgrade immediately by running pip install --upgrade aiohttp>=3.13.4 or updating your project's dependency specification. For immediate mitigation in older versions, applications should disable automatic redirect following (set allow_redirects=False in client requests) and manually validate redirect destinations before making follow-up requests, ensuring credential headers are re-evaluated for each new origin. See the security advisory at https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9 for additional details.