All vulnerabilities
CVE-2026-111066GHSA-9xw5-w5jj-pvcg

AIOHTTP: File descriptor exhaustion in multipart requests

aio-libs aiohttppipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.14.4Fixed versionGitHub
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 3.14.4aiohttp, pipGitHub
  • 3.14.4aiohttp, PyPIOSVpip install "aiohttp>=3.14.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

An attacker can exhaust file descriptors with specially crafted multipart requests.

Impact

If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.

Text from GitHub Advisory Database

Affected versions 53

  • aiohttp, pip>= 2.0.0, < 3.14.4GitHub
  • aiohttpaffected: >= 2.0.0, < 3.14.4CVE List
  • aiohttp, PyPIfrom 2.0.0, fixed in 3.14.4OSV
  • aiohttp, PyPI2.0.0OSV
  • aiohttp, PyPI2.0.1OSV
  • aiohttp, PyPI2.0.2OSV
  • aiohttp, PyPI2.0.3OSV
  • aiohttp, PyPI2.0.4OSV
  • aiohttp, PyPI2.0.5OSV
  • aiohttp, PyPI2.0.6OSV
  • aiohttp, PyPI2.0.7OSV
  • aiohttp, PyPI2.1.0OSV
  • aiohttp, PyPI2.2.0OSV
  • aiohttp, PyPI2.2.1OSV
  • aiohttp, PyPI2.2.2OSV
  • aiohttp, PyPI2.2.3OSV
  • aiohttp, PyPI2.2.4OSV
  • aiohttp, PyPI2.2.5OSV
  • aiohttp, PyPI2.3.0OSV
  • aiohttp, PyPI2.3.0a1OSV
  • aiohttp, PyPI2.3.0a2OSV
  • aiohttp, PyPI2.3.0a3OSV
  • aiohttp, PyPI2.3.0a4OSV
  • aiohttp, PyPI2.3.1OSV
  • aiohttp, PyPI2.3.10OSV
  • aiohttp, PyPI2.3.1a1OSV
  • aiohttp, PyPI2.3.2OSV
  • aiohttp, PyPI2.3.2b2OSV
  • aiohttp, PyPI2.3.2b3OSV
  • aiohttp, PyPI2.3.3OSV
  • aiohttp, PyPI2.3.4OSV
  • aiohttp, PyPI2.3.5OSV
  • aiohttp, PyPI2.3.6OSV
  • aiohttp, PyPI2.3.7OSV
  • aiohttp, PyPI2.3.8OSV
  • aiohttp, PyPI2.3.9OSV
  • aiohttp, PyPI3.0.0OSV
  • aiohttp, PyPI3.0.0b0OSV
  • aiohttp, PyPI3.0.0b1OSV
  • aiohttp, PyPI3.0.0b2OSV
  • aiohttp, PyPI3.0.0b3OSV
  • aiohttp, PyPI3.0.0b4OSV
  • aiohttp, PyPI3.0.1OSV
  • aiohttp, PyPI3.0.2OSV
  • aiohttp, PyPI3.0.3OSV
  • aiohttp, PyPI3.0.4OSV
  • aiohttp, PyPI3.0.5OSV
  • aiohttp, PyPI3.0.6OSV
  • aiohttp, PyPI3.0.7OSV
  • aiohttp, PyPI3.0.8OSV
  • aiohttp, PyPI3.0.9OSV
  • aiohttp, PyPI3.1.0OSV
  • aiohttp, PyPI3.1.1OSV

References 5