Technical impact
AIOHTTP allows the TLS Server Name Indication (SNI) check to be ignored when an existing connection is reused, enabling an attacker to override the intended server hostname and connect to a different target than specified. This flaw may allow traffic intended for one domain to be inadvertently routed to another, potentially exposing data or enabling subtle man‑in‑the‑middle interference. The official CVSS score of 2.7 indicates a low severity, reflecting that the flaw requires precise control over application‑level request parameters and that it does not grant immediate credential compromise or arbitrary code execution.
Affected Systems
The issue affects the aio-libs aiohttp library, versions prior to 3.14.1, which runs on Python/asyncio environments. Applications that use this library to issue multiple HTTPS requests to the same domain while specifying different per‑request server_hostname values are impacted.
Risk and Exploitability
The vulnerability is low risk, with an EPSS score of < 1% and no listing in the CISA KEV catalog. It is inferred that the attack vector requires an attacker to control or influence application‑level request parameters and that it does not grant immediate credential compromise or arbitrary code execution. The low CVSS score and lack of evidence of active exploitation further suggest limited immediate threat. However, any deployment using older aiohttp versions should be updated to eliminate the possibility of server hostname mis‑resolution during connection reuse.
Github GHSA