CVE-2026-54275: aio-libs aiohttp TLS SNI check bypass during connection reuse

CVE-2026-54275 · Severity: medium · CVSS 4 · Published 2026-06-22

AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw allows the library to incorrectly reuse existing secure connections even when a new request specifies a different hostname for security verification. This could allow a connection to a potentially untrusted or incorrect server to be treated as valid, bypassing standard security checks intended to ensure the client is talking to the correct destination.

Technologies: aiohttp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54275 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54275 being exploited in the wild.
How severe is CVE-2026-54275?
Medium severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
aiohttp (PyPI) <= 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.1.
Is there a fix for CVE-2026-54275?
Yes. aiohttp (PyPI): upgrade to 3.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54275 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54275?
Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • aiohttp (PyPI): upgrade to 3.14.1 or later
    pip install "aiohttp>=3.14.1"

Technical details

A vulnerability exists in aiohttp's connection pooling logic where the TLS Server Name Indication (SNI) check (server_hostname) is bypassed during connection reuse. When an application makes multiple HTTPS requests to the same domain but specifies different per-request server_hostname parameters, the library may reuse an established connection from a previous request. This occurs because the connection pooler fails to verify that the existing connection's TLS context matches the new request's hostname requirements. An attacker could potentially exploit this to maintain a connection that should have been rejected under stricter SNI validation. The issue is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch) and is fixed in version 3.14.1.

Affected products

  • aio-libs aiohttp < 3.14.1

Identifiers

  • CVE-2026-54275
  • GHSA-4m7w-qmgq-4wj5
  • PYSEC-2026-237

Timeline

  • 2026-06-08: advisory: GitHub advisory GHSA-4m7w-qmgq-4wj5 published
  • 2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.