{"id":"CVE-2026-54275","aliases":["GHSA-4m7w-qmgq-4wj5","PYSEC-2026-237"],"title":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","severity":"low","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.1"],"patched":["aiohttp 3.14.1"],"published":"2026-06-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:48.205198252Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/advisories/GHSA-4m7w-qmgq-4wj5"}],"tags":["osv","pip","ghsa"],"epss":0.0047,"epssPercentile":0.38087,"cwe":["CWE-297"],"ingestedAt":"2026-07-07T15:41:58.681Z","slug":"CVE-2026-54275","body":"## Overview\n\n### Summary\n\nThe `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.\n\n### Impact\n\nIf an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.\n\n### Workaround\n\nDisable keep_alive if you need to change the `server_hostname` check between requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0\n\n## Affected packages\n\n- `aiohttp < 3.14.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.1`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}