Connection Pool Vulnerability in AIOHTTP Framework by aio-libs
CVE-2026-111065

6.9MEDIUM

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111065?

The AIOHTTP framework, utilized for building asynchronous HTTP clients and servers in Python, contains a vulnerability in its Max-Age processing prior to version 3.14.4. This flaw can lead to an overflow condition that prevents proper closure of connections, allowing an attacker to temporarily deplete the connection pool, which may disrupt services until garbage collection resolves the lingering connections. To mitigate this issue, it is recommended to upgrade to AIOHTTP version 3.14.4 or later.

Affected Version(s)

aiohttp < 3.14.4

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f12...
x_refsource_MISC
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.