CVE-2026-54275

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description The server hostname TLS SNI (Server Name Indication) check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain using different per-request server hostname parameters, subsequent calls may succeed by reusing the existing connection instead of being rejected by the TLS SNI check.

Recommendations Update to version 3.14.1. As a temporary workaround, disable keep alive if the server hostname check must be changed between requests.