CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

June 15, 2026

The server_hostname TLS SNI check can be bypassed when an existing connection is reused.

References

github.com/advisories/GHSA-4m7w-qmgq-4wj5
github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5
nvd.nist.gov/vuln/detail/CVE-2026-54275

Code Behaviors & Features

Detect and mitigate CVE-2026-54275 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →