---
schema_version: '1.0'
id: security-20260711-347a7c
url: https://osv.dev/vulnerability/PYSEC-2026-237
url_hash: 347a7cd2346feb12dcdf891ba9a6d85c553843ef3939478f6869429fac78ed31
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-237
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54275
- PYSEC-2026-237
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-11T06:37:17Z'
updated_at: '2026-07-11T06:38:28Z'
status: published
content_hash: 39d705a2f6907a9c91d11a9dafb2578ea705561fce7d9cf91308d1691be4257a
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing
  connection is reused. If an application makes multiple requests to the same domain,
  but with different per-request s
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when
  an existing connection is reused. If an application makes multiple requests to the
  same domain, but with different per-request s
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54275 — aiohttp
---

# CVE-2026-54275 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request s

## Key Points
- cve / CVE-2026-54275 / PYSEC-2026-237 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-237 (CVE-2026-54275)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-237_

## Source
元記事: [CVE-2026-54275 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-237) — published 2026-06-22T18:16:46Z