PT-2026-49589 · Pypi · Aiohttp

Publicado 2026-06-15 · Atualizado 2026-06-15 · CVE-2026-54275

OSV

CVSS v4.0

2.7

Baixa

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Summary

The server hostname TLS SNI check can be bypassed when an existing connection is reused.

Impact

If an application makes multiple requests to the same domain, but with different per-request server hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.

Workaround

Disable keep alive if you need to change the server hostname check between requests.

---

Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0

Correção

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

CVE-2026-54275

GHSA-4M7W-QMGQ-4WJ5

Produtos afetados

Aiohttp

Referências · 3

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5 · Nota
• https://github.com/aio-libs/aiohttp · Nota
• https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5 · Aviso do Fabricante