PT-2026-49589 · Pypi · Aiohttp

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-54275

OSV

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Summary

The server hostname TLS SNI check can be bypassed when an existing connection is reused.

Impact

If an application makes multiple requests to the same domain, but with different per-request server hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.

Workaround

Disable keep alive if you need to change the server hostname check between requests.

---

Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2026-54275

GHSA-4M7W-QMGQ-4WJ5

Affected Products

Aiohttp

References · 3

• https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5 · Vendor Advisory
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5 · Note
• https://github.com/aio-libs/aiohttp · Note