Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-111750 · GHSA-pqxq-w44r-73xw

AIOHTTP: Pure-Python parser request smuggling

Risk score
54/100
CVSS
6.3 v4.0
Exploit chance (30 days)
0.4%
Published
19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an …
Affected
aiohttp (pip) <= 3.14.3
Fix
Upgrade aiohttp to 3.14.4 or later.
Exploitation
No known exploitation

Story map

Story map: aiohttpTHE FLAWSTHE FIXCVE-2026-111750AIOHTTP: Pure-Python parserrequest smugglingCVSS 6.3 · EPSS 0%CVE-2026-111066AIOHTTP: File descriptorexhaustion in multipartrequestsCVSS 8.2 · EPSS 0%CVE-2026-111064Aiohttp server lacks an initialrequest/header timeoutCVSS 8.2 · EPSS 0%GHSA-2g87-pp6c-29x5Multiple instances of excessiveor unbounded memory/CPU useCVSS 8.7Upgrade aiohttp3.14.4or later on your release lineWho is exposed{'products': ['aiohttp'],'packages': ['aiohttp'],'versions': ['>= 2.0.0, < 3.14.4']}AMBER · PATCH THIS WEEKaiohttpAIOHTTP has a file descriptorexhaustion vulnerability inmultipart requests, allowing anattacker to exhaust filedescriptors with speciallycrafted requests. This could leadto a denial of service.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-444 (CWE-444)28 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

aiohttp: Amber, patch this week. AIOHTTP has a file descriptor exhaustion vulnerability in multipart requests, allowing an attacker to exhaust file descriptors with specially crafted requests. This could lead to a denial of service.

The flaws

  • CVE-2026-111750: AIOHTTP: Pure-Python parser request smuggling (CVSS 6.3 · EPSS 0%)
  • CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2 · EPSS 0%)
  • CVE-2026-111064: Aiohttp server lacks an initial request/header timeout (CVSS 8.2 · EPSS 0%)
  • GHSA-2g87-pp6c-29x5: Multiple instances of excessive or unbounded memory/CPU use (CVSS 8.7)

The fix

Upgrade aiohttp: 3.14.4 or later on your release line

Who is exposed: {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['>= 2.0.0, < 3.14.4']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.3 medium
  • On your watchlist: python, PyPI

Affected packages

PackageEcosystemVulnerableFixed in
aiohttppip<= 3.14.33.14.4

References

Original description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

Last activity 19 Oct 2026. Patch Forecast updates every hour.