{"id":"CVE-2026-111065","kind":"vulnerability","aliases":["CVE-2026-111065","GHSA-6cjc-53gc-5rqm"],"related":[],"title":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.","summary":"aiohttp, a Python async HTTP client and server library, has an overflow in its Max-Age cookie handling that can cause a connection to be left unclosed. An attacker can exhaust the connection pool until garbage collection frees the connections, which causes a temporary denial of service.","severity":"medium","cvss":6.9,"epss":0.003650000086054206,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":"<= 3.14.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-770","package","python","web-services"],"not_affected_if":["aiohttp-version-3.14.4-or-later"],"how_to_check":"pip show aiohttp (or check the lockfile) and compare the installed version against 3.14.4","fix":"Upgrade aiohttp to 3.14.4 or later.","status":"open","published_at":"2026-10-19T17:17:03+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:26+00:00","updated_at":"2026-10-23T21:57:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade aiohttp to 3.14.4 or later.","summary":"aiohttp, a Python async HTTP client and server library, has an overflow in its Max-Age cookie handling that can cause a connection to be left unclosed. An attacker can exhaust the connection pool until garbage collection frees the connections, which causes a temporary denial of service.","category":"package","who_cares":["python","aiohttp","web-services"],"confidence":0.8,"analyst_note":"","how_to_check":"pip show aiohttp (or check the lockfile) and compare the installed version against 3.14.4\nunknown","needs_analyst":false,"not_affected_if":["aiohttp-version-3.14.4-or-later"],"severity_if_unknown":"medium"},"cost_usd":0.000333,"input_tokens":2026,"output_tokens":261,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111065':12A,20A '-2026':11A,19A '-770':24B '3.14.4':91C,124C '53gc':16A '5rqm':17A '6cjc':15A 'age':8A,46B,94C 'aiohttp':1A,21A,22B,30B,78C 'async':33B 'asynchron':81C 'asyncio':86C 'attack':59B,104C 'caus':51B,72B 'client':35B 'client/server':83C 'close':100C 'collect':67B,114C 'connect':53B,63B,70B,102C,109C,117C 'connector':2A 'consequ':106C 'cooki':47B 'cve':10A,18A 'cwe':23B 'denial':75B 'exhaust':4A,61B,107C 'fix':121C 'framework':84C 'free':68B 'garbag':66B,113C 'ghsa':14A 'ghsa-6cjc-53gc-5rqm':13A 'handl':48B 'http':34B,82C 'issu':119C 'left':56B 'librari':38B 'max':7A,45B,93C 'max-ag':6A,44B,92C 'overflow':9A,41B,97C 'packag':25B 'pool':3A,64B,110C 'prior':89C 'process':95C 'python':26B,32B,88C 'resolv':115C 'server':37B 'servic':29B,77B 'skip':99C 'temporari':74B 'temporarili':111C 'unclos':57B 'version':123C 'via':5A 'web':28B 'web-servic':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6cjc-53gc-5rqm","url":"https://github.com/advisories/GHSA-6cjc-53gc-5rqm","severity":"medium","published_at":"2026-10-20T19:57:24+00:00","modified_at":"2026-10-20T19:57:25+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111065","severity":null,"published_at":"2026-10-19T17:17:03+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}