Keepalive Timeout Handling Issue in AIOHTTP Framework

CVE-2026-111064

What is CVE-2026-111064?

AIOHTTP, an asynchronous HTTP client and server framework for Python, suffers from a vulnerability where keepalive timeout handling is effectively missing during the initial request phase. This allows an attacker to maintain an idle connection indefinitely, leading to potential exhaustion of server resources and connection capacity. The issue has been addressed in version 3.14.4, which introduces proper handling of keepalive timeouts to mitigate this risk.

References