CVE-2026-111064GHSA-5wr8-gcqf-gqf3

aiohttp server lacks an initial request/header timeout

aio-libs aiohttppipLibraries & packages

CVSS

8.2High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.14.4Fixed versionGitHub

Published19 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.