TLS SNI Bypass in AIOHTTP via Connection Reuse

Executive Summary

CVE-2026-54275 is a vulnerability in the aiohttp library (versions up to 3.14.0) that allows bypassing the server_hostname TLS SNI check when HTTPS connections are reused.

Specifically, if an application makes multiple requests to the same domain but uses different server_hostname parameters for each request, the later requests may incorrectly succeed by reusing an existing connection. This reuse bypasses the intended TLS SNI check, which should reject such requests.

This issue is fixed in aiohttp version 3.14.1.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in aiohttp version 3.14.1. The immediate step to mitigate this issue is to upgrade aiohttp to version 3.14.1 or later.

As a workaround, if upgrading is not immediately possible, you can disable the keep_alive feature in aiohttp when making requests that change the server_hostname parameter. This prevents connection reuse and thus avoids the TLS SNI check bypass.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect acceptance of TLS connections where the server_hostname parameter differs from the original connection, potentially allowing unauthorized or unintended connections to succeed.

While the severity is considered low, it may cause security issues in applications that rely on strict TLS SNI checks to validate server identities, possibly leading to information disclosure or man-in-the-middle risks if exploited.

A temporary workaround is to disable keep_alive when changing the server_hostname between requests to prevent connection reuse.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the bypass of the server_hostname TLS SNI check when HTTPS connections are reused with different server_hostname parameters. Detection would involve monitoring or inspecting HTTPS requests made by applications using aiohttp versions prior to 3.14.1 to see if multiple requests to the same domain use different server_hostname values while reusing connections.

Since the issue is related to connection reuse and TLS SNI checks, one approach is to analyze network traffic for TLS Client Hello messages and verify if the SNI values differ across reused connections. However, no specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0