CVE Explorer

CVE-2026-54275

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a9ea5cb2dd6fddff41e2e1598ab2628f37e0f70914c2f67a7841b316c7641d17

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"aiohttp","vendor":"aio-libs","versions":[{"status":"affected","version":"< 3.14.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:51389ff4c81d6f7ec4421040cd697ea754f06fe863f774a80416653ade96507c · sha256:35611092f6e23fe9… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":2.7,"baseSeverity":"LOW","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:51389ff4c81d6f7ec4421040cd697ea754f06fe863f774a80416653ade96507c · sha256:35611092f6e23fe9… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-297","description":"CWE-297: Improper Validation of Certificate with Host Mismatch","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:51389ff4c81d6f7ec4421040cd697ea754f06fe863f774a80416653ade96507c · sha256:35611092f6e23fe9… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:51389ff4c81d6f7ec4421040cd697ea754f06fe863f774a80416653ade96507c · sha256:35611092f6e23fe9… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer