CVE-2026-111066

8.2High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-770

Impact

Remote, unauthenticated attackers can crash the server via denial of service by exhausting open file descriptors. They only need network access to send specially crafted multipart requests to handlers calling Request.post().

Root cause

Multipart request processing fails to close open file descriptors, keeping an unbounded number allocated during handling.

Affected systems

AIOHTTP 2.0.0 through versions prior to 3.14.4

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade AIOHTTP to version 3.14.4 or later. No interim mitigation is provided; patching is required if endpoints use Request.post() with multipart data.

shell

$ pip install --upgrade 'aiohttp>=3.14.4'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111066