All vulnerabilities
CVE-2026-111065GHSA-6cjc-53gc-5rqm

AIOHTTP: Connector pool exhaustion via Max-Age overflow

aio-libs aiohttppipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.14.4Fixed versionGitHub
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 3.14.4aiohttp, pipGitHub
  • 3.14.4aiohttp, PyPIOSVpip install "aiohttp>=3.14.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

An overflow in Max-Age processing can skip closing a connection.

Impact

An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.

Text from GitHub Advisory Database

Affected versions 53

  • aiohttp, pip<= 3.14.3GitHub
  • aiohttpaffected: < 3.14.4CVE List
  • aiohttp, PyPIfrom first release, fixed in 3.14.4OSV
  • aiohttp, PyPI0.1OSV
  • aiohttp, PyPI0.10.0OSV
  • aiohttp, PyPI0.10.1OSV
  • aiohttp, PyPI0.10.2OSV
  • aiohttp, PyPI0.11.0OSV
  • aiohttp, PyPI0.12.0OSV
  • aiohttp, PyPI0.13.0OSV
  • aiohttp, PyPI0.13.1OSV
  • aiohttp, PyPI0.14.0OSV
  • aiohttp, PyPI0.14.1OSV
  • aiohttp, PyPI0.14.2OSV
  • aiohttp, PyPI0.14.3OSV
  • aiohttp, PyPI0.14.4OSV
  • aiohttp, PyPI0.15.0OSV
  • aiohttp, PyPI0.15.1OSV
  • aiohttp, PyPI0.15.2OSV
  • aiohttp, PyPI0.15.3OSV
  • aiohttp, PyPI0.16.0OSV
  • aiohttp, PyPI0.16.1OSV
  • aiohttp, PyPI0.16.2OSV
  • aiohttp, PyPI0.16.3OSV
  • aiohttp, PyPI0.16.4OSV
  • aiohttp, PyPI0.16.5OSV
  • aiohttp, PyPI0.16.6OSV
  • aiohttp, PyPI0.17.0OSV
  • aiohttp, PyPI0.17.1OSV
  • aiohttp, PyPI0.17.2OSV
  • aiohttp, PyPI0.17.3OSV
  • aiohttp, PyPI0.17.4OSV
  • aiohttp, PyPI0.18.0OSV
  • aiohttp, PyPI0.18.1OSV
  • aiohttp, PyPI0.18.2OSV
  • aiohttp, PyPI0.18.3OSV
  • aiohttp, PyPI0.18.4OSV
  • aiohttp, PyPI0.19.0OSV
  • aiohttp, PyPI0.2OSV
  • aiohttp, PyPI0.20.0OSV
  • aiohttp, PyPI0.20.1OSV
  • aiohttp, PyPI0.20.2OSV
  • aiohttp, PyPI0.21.0OSV
  • aiohttp, PyPI0.21.1OSV
  • aiohttp, PyPI0.21.2OSV
  • aiohttp, PyPI0.21.4OSV
  • aiohttp, PyPI0.21.5OSV
  • aiohttp, PyPI0.21.6OSV
  • aiohttp, PyPI0.22.0OSV
  • aiohttp, PyPI0.22.0a0OSV
  • aiohttp, PyPI0.22.0b0OSV
  • aiohttp, PyPI0.22.0b1OSV
  • aiohttp, PyPI0.22.0b2OSV

References 5