2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54275

CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54275

CVE-2026-54275:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.14.0	3.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the connection pooling mechanism of aiohttp's ClientSession. When making multiple HTTPS requests, aiohttp can reuse existing connections to improve performance. The key used to identify a reusable connection is generated by the ClientRequest.connection_key method. The vulnerability description states that the server_hostname TLS SNI check can be bypassed when a connection is reused. The provided patch confirms this by modifying aiohttp/client_reqrep.py. Specifically, it adds the server_hostname attribute to the ConnectionKey named tuple and includes it in the key's calculation within the ClientRequest.connection_key property. This change ensures that requests with different server_hostname values will have different connection keys, preventing the connection pool from reusing a connection that was established with a different SNI hostname. Therefore, the ClientRequest.connection_key function is the root cause of the vulnerability, as its incomplete key generation allowed for the bypass of security checks.

Vulnerable functions

ClientRequest.connection_key

aiohttp/client_reqrep.py

The `ClientRequest.connection_key` method generates a key used for connection pooling. Prior to the patch, this key did not include the `server_hostname` parameter. This meant that if a connection was already established to a host, a subsequent request to the same host but with a different `server_hostname` for the TLS SNI check could incorrectly reuse the existing connection. This would bypass the SNI check for the second request. The patch addresses this by incorporating `server_hostname` into the `ConnectionKey`, ensuring that connections are not reused when the `server_hostname` differs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.