CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg
AIOHTTP: File descriptor exhaustion in multipart requests
- Risk score
- 65/100
- CVSS
- 8.2 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AIOHTTP has a file descriptor exhaustion vulnerability in multipart requests, allowing an attacker to exhaust file descriptors with specially crafted requests. This could lead to a denial of service.
- Affected
- {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['>= 2.0.0, < 3.14.4']}
- Fix
- Upgrade to version 3.14.4 or later
- Exploitation
- No known exploitation
Story map
At a glance
aiohttp: Amber, patch this week. The aiohttp server lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely, consuming server connection capacity.
The flaws
- CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2 · EPSS 0%)
- CVE-2026-111064: Aiohttp server lacks an initial request/header timeout (CVSS 8.2 · EPSS 0%)
- GHSA-2g87-pp6c-29x5: Multiple instances of excessive or unbounded memory/CPU use (CVSS 8.7)
- CVE-2026-111065: AIOHTTP: Connector pool exhaustion via Max-Age overflow (CVSS 6.9 · EPSS 0%)
The fix
Upgrade aiohttp: 3.14.4 or later on your release line
Who is exposed: {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['<= 3.14.3']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| aiohttp | pip | >= 2.0.0, < 3.14.4 | 3.14.4 |
References
- https://github.com/advisories/GHSA-9xw5-w5jj-pvcg
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
- https://nvd.nist.gov/vuln/detail/CVE-2026-111066
- https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
- https://github.com/advisories/GHSA-9xw5-w5jj-pvcg
Original description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
Last activity 19 Oct 2026. Patch Forecast updates every hour.