Patch Forecast
Amber warning
Patch this week.

CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3

aiohttp server lacks an initial request/header timeout

Risk score
66/100
CVSS
8.2 v4.0
Exploit chance (30 days)
0.4%
Published
19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The aiohttp server lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely, consuming server connection capacity.
Affected
{'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['<= 3.14.3']}
Fix
Upgrade to version 3.14.4 or later
Exploitation
No known exploitation

Story map

Story map: aiohttpTHE FLAWSTHE FIXCVE-2026-111064Aiohttp server lacks an initialrequest/header timeoutCVSS 8.2 · EPSS 0%CVE-2026-111066AIOHTTP: File descriptorexhaustion in multipartrequestsCVSS 8.2 · EPSS 0%GHSA-2g87-pp6c-29x5Multiple instances of excessiveor unbounded memory/CPU useCVSS 8.7CVE-2026-111750AIOHTTP: Pure-Python parserrequest smugglingCVSS 6.3 · EPSS 0%Upgrade aiohttp3.14.4or later on your release lineWho is exposed{'products': ['aiohttp'],'packages': ['aiohttp'],'versions': ['>= 2.0.0, < 3.14.4']}AMBER · PATCH THIS WEEKaiohttpAIOHTTP has a file descriptorexhaustion vulnerability inmultipart requests, allowing anattacker to exhaust filedescriptors with speciallycrafted requests. This could leadto a denial of service.Where it standsNo known exploitationCONNECTS TOSame weaknessDenial of service (CWE-770)204 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

aiohttp: Amber, patch this week. AIOHTTP has a file descriptor exhaustion vulnerability in multipart requests, allowing an attacker to exhaust file descriptors with specially crafted requests. This could lead to a denial of service.

The flaws

  • CVE-2026-111064: Aiohttp server lacks an initial request/header timeout (CVSS 8.2 · EPSS 0%)
  • CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2 · EPSS 0%)
  • GHSA-2g87-pp6c-29x5: Multiple instances of excessive or unbounded memory/CPU use (CVSS 8.7)
  • CVE-2026-111750: AIOHTTP: Pure-Python parser request smuggling (CVSS 6.3 · EPSS 0%)

The fix

Upgrade aiohttp: 3.14.4 or later on your release line

Who is exposed: {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['>= 2.0.0, < 3.14.4']}

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.2 high
  • Remotely exploitable without logging in
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
aiohttppip<= 3.14.33.14.4

References

Original description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Last activity 19 Oct 2026. Patch Forecast updates every hour.