tocsin

PyPI/aiohttp CVE-2026-54275: high 7.5, EPSS 0.47%

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an applicat

Action: Upgrade aiohttp to 3.14.1 or later.

pip install aiohttp==3.14.1

Affected

introducedfixedlast affected
03.14.1-

Fixed versions

3.14.1

Sources

CVE-2026-54275 · published · modified · JSON