Live › vulnerability › CVE-2026-111065
Go to dashboardaiohttp, a Python async HTTP client and server library, has an overflow in its Max-Age cookie handling that can cause a connection to be left unclosed. An attacker can exhaust the connection pool until garbage collection frees the connections, which causes a temporary denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
pip show aiohttp (or check the lockfile) and compare the installed version against 3.14.4
Upgrade aiohttp to 3.14.4 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111065")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.