CVE-2026-111064

8.2High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-770

Impact

Remote, unauthenticated attackers can cause a denial of service by exhausting server connection capacity. They only need network access to hold idle connections open indefinitely without sending initial request data.

Root cause

The server omits keepalive timeout handling during the initial phase of a connection before request data arrives.

Affected systems

aiohttp prior to 3.14.4

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade to aiohttp 3.14.4 or later. No interim configuration mitigation is provided in the advisory, so prioritize updating the package.

shell

$ pip install --upgrade 'aiohttp>=3.14.4'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111064