CVE-2026-111065 ยท GHSA-6cjc-53gc-5rqm
AIOHTTP: Connector pool exhaustion via Max-Age overflow
- Risk score
- 52/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
- Affected
- aiohttp (pip) <= 3.14.3
- Fix
- Upgrade aiohttp to 3.14.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| aiohttp | pip | <= 3.14.3 | 3.14.4 |
References
- https://github.com/advisories/GHSA-6cjc-53gc-5rqm
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm
- https://nvd.nist.gov/vuln/detail/CVE-2026-111065
- https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
- https://github.com/advisories/GHSA-6cjc-53gc-5rqm
Original description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
Last activity 19 Oct 2026. Patch Forecast updates every hour.