CVE-2026-54275
published 2026-06-22CVE-2026-54275: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.27%
18.3th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.
Affected
110 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse
vendor_redhat·2026-06-22·CVSS 2.7
CVE-2026-54275 [LOW] CWE-367 aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse
aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse
A flaw was found in aiohttp, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to bypass the Transport Layer Security (TLS) Server Name Indication (SNI) check. This occurs when an application reuses an existing connection for multiple requests to the same domain but with different server_hostname parameters. Consequently, later requests may succeed by reusing the existing connection, even if they should have been rejected due to the TLS SNI check, potentially leading to unintended information disclosure or integrity issues.
Statement: This vulnerability is rated Moderate because a remote attacker may be able to bypass TLS Server Name Indication (SNI) hostname checks when an aiohttp HTTP cl
VulDB
aio-libs aiohttp up to 3.14.0 certificate host validation (GHSA-4m7w-qmgq-4wj5)
vuldb·2026-06-22·CVSS 2.7
CVE-2026-54275 [LOW] aio-libs aiohttp up to 3.14.0 certificate host validation (GHSA-4m7w-qmgq-4wj5)
A vulnerability described as problematic has been identified in aio-libs aiohttp up to 3.14.0. This affects an unknown part. Executing a manipulation can lead to certificate with host mismatch.
This vulnerability appears as CVE-2026-54275. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
ghsa·2026-06-15
CVE-2026-54275 [LOW] CWE-297 aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
### Summary
The `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.
### Impact
If an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.
### Workaround
Disable keep_alive if you need to change the `server_hostname` check between requests.
Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
No detection rules found.
No public exploits indexed.
2026-06-22
Published