Live › vulnerability › CVE-2026-111066
Go to dashboardaiohttp, a Python async HTTP library, can be made to open an unbounded number of file descriptors when a handler calls Request.post() on a crafted multipart request. An attacker can exhaust file descriptors and cause resource exhaustion on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | >= 2.0.0, < 3.14.4 | 3.14.4 |
pip show aiohttp or python -c "import aiohttp; print(aiohttp.version)" and check whether it is >= 2.0.0 and < 3.14.4Upgrade aiohttp to 3.14.4 or later (pip install -U "aiohttp>=3.14.4").
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111066")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.