Executive brief
AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw allows the library to incorrectly reuse existing secure connections even when a new request specifies a different hostname for security verification. This could allow a connection to a potentially untrusted or incorrect server to be treated as valid, bypassing standard security checks intended to ensure the client is talking to the correct destination.
Technical details
A vulnerability exists in aiohttp's connection pooling logic where the TLS Server Name Indication (SNI) check (server_hostname) is bypassed during connection reuse. When an application makes multiple HTTPS requests to the same domain but specifies different per-request server_hostname parameters, the library may reuse an established connection from a previous request. This occurs because the connection pooler fails to verify that the existing connection's TLS context matches the new request's hostname requirements. An attacker could potentially exploit this to maintain a connection that should have been rejected under stricter SNI validation. The issue is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch) and is fixed in version 3.14.1.
Affected products
- aio-libs aiohttp < 3.14.1
Timeline
- 2026-06-08: advisory: GitHub advisory GHSA-4m7w-qmgq-4wj5 published
- 2026-06-22: disclosed: NVD publication date