Medium4.8Red Hat Linux Updated
TLS SNI check bypass via connection reuse
CVE-2026-54275 Published Jun 22, 2026Updated by vendor Jun 22, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Summary
TLS SNI check bypass via connection reuse. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-367.
Affected versions
- < 3.14.1
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Mitigation checklist
Recommended fix / mitigation
- Update the aiohttp package to version 3.14.1 or later. Until updated builds are available, disable HTTP keep-alive (keep_alive) for aiohttp client sessions where per-request server_hostname TLS SNI overrides must be enforced between requests to the same host. Installations that do not use per-request server_hostname overrides, or that use aiohttp only as a server, are not affected by this flaw.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.