Live › vulnerability › CVE-2026-111064
Go to dashboardaiohttp's server did not apply its keepalive timeout to the start of a new request, so a client could hold an idle connection open indefinitely without sending data. An attacker can tie up server connections and exhaust resources by opening many such connections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
pip show aiohttp (or check the lockfile) and look for a version at or below 3.14.3
Source says the server is affected when running aiohttp directly, which is the default for an aiohttp web app without a reverse proxy in front
3.14.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111064")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.