---
schema_version: '1.0'
id: security-20260711-62a631
url: https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5
url_hash: 62a631c02bf65012edc5c64c28ace8c3c67b621a2a7a8cf81cb7cd55225fc75f
canonical_url: https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54275
- GHSA-4m7w-qmgq-4wj5
- severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- aiohttp
- PyPI
lang: en
published_at: '2026-06-15T20:11:13Z'
fetched_at: '2026-07-11T06:37:17Z'
updated_at: '2026-07-11T06:37:45Z'
status: published
content_hash: 4468be8b107a28a46cf2e81f60d61fd1961329440d475fd65270f191cbfc7b6b
license_note: full
summary: 'aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections'
summary_source: rss
summary_en: 'aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections'
entities:
- name: TLS_CERTIFICATES
  type: content
- name: Server Card
  type: artifact
- name: chrome_settings_overrides
  type: artifact
key_facts: []
related: []
related_auto:
- name: SECURITY_TECHNIQUE
  type: concept
  weight: 1.0
- name: HACKERNES
  type: organization
  weight: 1.0
- name: IT_GENERAL
  type: concept
  weight: 1.0
- name: IT_TECH
  type: concept
  weight: 1.0
- name: IT_AI
  type: concept
  weight: 1.0
title: 'CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing
  HTTPS Connections'
---

# CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

## TL;DR
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

## Key Points
- cve / CVE-2026-54275 / GHSA-4m7w-qmgq-4wj5 / severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U / aiohttp / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
**Advisory:** GHSA-4m7w-qmgq-4wj5 (CVE-2026-54275)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
### Summary

The `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.

### Impact

If an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.

### Workaround

Disable keep_alive if you need to change the `server_hostname` check between requests.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5
- https://github.com/aio-libs/aiohttp

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5_

## Source
元記事: [CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections](https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5) — published 2026-06-15T20:11:13Z