CVE-2026-54275

LOW EPSS 17.9%
Published Jun 22, 20261w ago · Modified Jun 22, 20261w ago
2.7 CVSS 4.0
Low
Find Similar
Published Jun 22, 2026 1w ago
Last Modified Jun 22, 2026 1w ago

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

CVSS Details

Base Score
2.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
17.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-297

References 1

  • github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.