PT-2026-117499 · Pypi · Aiohttp
CVE-2026-111064
·
Published
2026-10-19
·
Updated
2026-10-19
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AIOHTTP versions prior to 3.14.4
Description
Keepalive timeout handling is absent during the initial portion of a request. This allows an attacker to maintain an idle connection indefinitely before transmitting any request data, which consumes server connection capacity.
Recommendations
Update to version 3.14.4.
Use a reverse proxy with sensible keepalive limits.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aiohttp