{"id":"CVE-2026-111066","kind":"vulnerability","aliases":["CVE-2026-111066","GHSA-9xw5-w5jj-pvcg"],"related":[],"title":"AIOHTTP: File descriptor exhaustion in multipart requests","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.","summary":"aiohttp, a Python async HTTP library, can be made to open an unbounded number of file descriptors when a handler calls Request.post() on a crafted multipart request. An attacker can exhaust file descriptors and cause resource exhaustion on the server.","severity":"high","cvss":8.2,"epss":0.003809999907389283,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":">= 2.0.0, < 3.14.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-400","cwe-770","package","python","self-hosted"],"not_affected_if":["no-request-post-usage","version-3.14.4-or-later"],"how_to_check":"Run pip show aiohttp or python -c \"import aiohttp; print(aiohttp.__version__)\" and check whether it is >= 2.0.0 and < 3.14.4.\nSearch the codebase for Request.post( to find handlers that parse multipart bodies.","fix":"Upgrade aiohttp to 3.14.4 or later (pip install -U \"aiohttp>=3.14.4\").","status":"open","published_at":"2026-10-19T17:17:03+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:28+00:00","updated_at":"2026-10-23T21:57:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade aiohttp to 3.14.4 or later (pip install -U \"aiohttp>=3.14.4\").\nunknown","summary":"aiohttp, a Python async HTTP library, can be made to open an unbounded number of file descriptors when a handler calls Request.post() on a crafted multipart request. An attacker can exhaust file descriptors and cause resource exhaustion on the server.","category":"package","who_cares":["python","aiohttp","self-hosted"],"confidence":0.8,"analyst_note":"","how_to_check":"Run pip show aiohttp or python -c \"import aiohttp; print(aiohttp.__version__)\" and check whether it is >= 2.0.0 and < 3.14.4.\nSearch the codebase for Request.post( to find handlers that parse multipart bodies.\nunknown","needs_analyst":false,"not_affected_if":["version-3.14.4-or-later","no-request-post-usage"],"severity_if_unknown":"high"},"cost_usd":0.000378,"input_tokens":2062,"output_tokens":344,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111066':10A,18A '-2026':9A,17A '-400':22B '-770':24B '2.0.0':82C '3.14.4':84C,121C '9xw5':13A 'aiohttp':1A,19A,20B,30B,70C 'async':33B 'asynchron':73C 'asyncio':78C 'attack':58B,99C 'call':50B 'caus':64B 'client/server':75C 'consequ':101C 'craft':54B,107C 'cve':8A,16A 'cwe':21B,23B 'descriptor':3A,46B,62B,96C,104C 'exhaust':4A,60B,66B,102C 'file':2A,45B,61B,95C,103C 'fix':118C 'framework':76C 'ghsa':12A 'ghsa-9xw5-w5jj-pvcg':11A 'handler':49B,112C 'host':29B 'http':34B,74C 'issu':116C 'librari':35B 'made':38B 'multipart':6A,55B,85C,108C 'number':43B,92C 'open':40B,94C 'packag':25B 'process':87C 'pvcg':15A 'python':26B,32B,80C 'request':7A,56B,86C,109C 'request.post':51B,114C 'resourc':65B 'retain':89C 'self':28B 'self-host':27B 'server':69B 'special':106C 'unauthent':98C 'unbound':42B,91C 'use':113C 'version':120C 'w5jj':14A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9xw5-w5jj-pvcg","url":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg","severity":"high","published_at":"2026-10-20T19:52:09+00:00","modified_at":"2026-10-20T19:52:10+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066","severity":null,"published_at":"2026-10-19T17:17:03+00:00","modified_at":"2026-10-20T17:17:29+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}