CVE-2026-54275: AIOHTTP TLS SNI Validation Bypass via Connection Reuse

Technical summary

The vulnerability exists in AIOHTTP's server_hostname TLS SNI (Server Name Indication) check. When a persistent connection is reused across multiple requests, the library fails to re-validate the SNI parameter if it differs from the original connection's hostname. This breaks the expected security model where each request can specify its own server_hostname for TLS verification. The flaw is rooted in CWE-297 (Improper Validation of Certificate with Host Mismatch), allowing bypass of certificate hostname verification under connection reuse scenarios. Applications that make multiple requests to the same IP or domain while varying the server_hostname parameter in their request configuration are vulnerable.

Business impact

For organizations using AIOHTTP in production, this vulnerability could enable man-in-the-middle (MITM) attacks in scenarios where connection pooling is enabled and multiple hostnames are used against shared infrastructure. The risk is highest in microservices architectures, API gateways, and client applications that connect to multiple TLS endpoints through the same underlying socket. A successful exploit would compromise confidentiality and integrity of HTTP traffic, potentially exposing sensitive data or allowing attackers to modify responses. However, exploitation requires specific application patterns and network positioning, limiting the immediate blast radius.

Affected systems

AIOHTTP versions prior to 3.14.1 are affected. This includes all 3.x versions up to and including 3.14.0, and any earlier major versions. The vulnerability affects both the server and client components when connection reuse is active. Python applications relying on AIOHTTP for HTTP communication—particularly those using asyncio patterns with persistent connections—should be evaluated for exploitation risk based on whether they vary server_hostname across requests.

Exploitability

While the vulnerability is technically exploitable without user interaction (network-based, low complexity), real-world exploitation requires specific conditions: the target application must reuse connections, vary server_hostname parameters, and be positioned such that an attacker can intercept network traffic. The attack surface is limited to applications with this exact usage pattern. AIOHTTP is not in the KEV catalog, suggesting limited evidence of active exploitation in the wild to date. However, the ease of triggering the flaw programmatically makes this a concern for forward-looking threat actors.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later. This patch addresses the TLS SNI validation logic to ensure server_hostname checks are enforced even when connections are reused. Organizations should prioritize patching development and production environments where AIOHTTP processes sensitive data or handles authentication tokens. No workarounds exist short of disabling connection pooling, which would degrade performance significantly.

Patch guidance

Apply the vendor patch to AIOHTTP 3.14.1 or later through your dependency manager (pip, poetry, etc.). Verify the upgrade in your requirements.txt, setup.py, or equivalent by running 'pip show aiohttp' to confirm the installed version. If your application uses pinned versions, update the constraint accordingly. Test thoroughly in staging environments, especially if your application employs custom connection pooling or SNI configurations. Consider automating this update in your CI/CD pipeline to prevent regression.

Detection guidance

Monitor AIOHTTP version inventory across your codebase and deployments. Search dependency manifests (requirements.txt, pyproject.toml, Pipfile) for aiohttp < 3.14.1. Implement application logging to track server_hostname parameters in outgoing TLS connections and flag instances where the same connection services multiple hostnames. Network-level detection is difficult; focus on inventory and code review to identify vulnerable patterns where server_hostname varies per request on a shared connection pool.

Why prioritize this

This vulnerability carries a HIGH CVSS score (7.5) driven by its network-exploitable nature and potential for availability/integrity impact. However, prioritization should be tempered by the fact that exploitation requires specific application architecture patterns and network positioning. Organizations should treat this as a near-term patch, but the urgency is lower than vulnerabilities affecting default configurations or widely used features. Given the absence from the KEV catalog, focus on applications that explicitly use varying server_hostname parameters or proxy-like functionality.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an Attack Vector of Network, Attack Complexity of Low, requiring no Privileges or User Interaction, with no scope change. The impact assessment shows no Confidentiality or Integrity loss in the base vector, but Availability is rated as High. This appears to reflect the library's behavior under connection exhaustion or denial-of-service scenarios rather than direct data exposure. Organizations handling high-value transaction data should consider this a functional security control bypass and elevate internal risk scores accordingly.

Frequently asked questions