CVE-2026-54275: CWE-297: Improper Validation of Certificate with Host Mismatch in aio-libs aiohttp
### Summary The `server_hostname` TLS SNI check can be bypassed when an existing connection is reused. ### Impact If an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. ### Workaround Disable keep_alive if you need to change the `server_hostname` check between requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
AI Analysis
Technical Summary
CVE-2026-54275 affects aiohttp, an asynchronous HTTP client/server framework for Python. The vulnerability involves improper validation of TLS server certificates with host mismatches (CWE-297). Specifically, when an existing connection is reused, the server_hostname TLS SNI check can be bypassed if multiple requests to the same domain specify different server_hostname parameters. This can cause later requests to succeed when they should be rejected due to TLS SNI mismatch. The flaw is addressed in aiohttp version 3.14.1.
Potential Impact
The vulnerability could allow an attacker to bypass TLS server hostname verification when connections are reused, potentially undermining the security guarantees of TLS SNI checks. However, the CVSS score is low (2.7), indicating limited impact and exploitability. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.
CVE-2026-54275: CWE-297: Improper Validation of Certificate with Host Mismatch in aio-libs aiohttp
Description
### Summary The `server_hostname` TLS SNI check can be bypassed when an existing connection is reused. ### Impact If an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. ### Workaround Disable keep_alive if you need to change the `server_hostname` check between requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
CVSS v4.0
Score 2.7low
Affected software
aio-libs
aiohttp
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54275 affects aiohttp, an asynchronous HTTP client/server framework for Python. The vulnerability involves improper validation of TLS server certificates with host mismatches (CWE-297). Specifically, when an existing connection is reused, the server_hostname TLS SNI check can be bypassed if multiple requests to the same domain specify different server_hostname parameters. This can cause later requests to succeed when they should be rejected due to TLS SNI mismatch. The flaw is addressed in aiohttp version 3.14.1.
Potential Impact
The vulnerability could allow an attacker to bypass TLS server hostname verification when connections are reused, potentially undermining the security guarantees of TLS SNI checks. However, the CVSS score is low (2.7), indicating limited impact and exploitability. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T17:13:32.280Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a39735beed863c81e39625a
Added to database: 06/22/2026, 17:39:39 UTC
Last enriched: 06/22/2026, 17:55:42 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 149
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.