VDB
CVE-2026-111066
CVE-2026-111066
PUBLISHED
CVSS 8.2 HIGH
Reported by GitHub_M · Published October 19, 2026
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
Risk Scores
CVSS 4.0
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| aio-libs | aiohttp | >= 2.0.0, < 3.14.4 |
| aio-libs | aiohttp | 2.0.0 |
| wolfi | kserve | 0 |
| chainguard | metaflow-service | 0 |
| chainguard | commercial-gitlab-cng-ee-fips-19.1 | 0 |
| chainguard | commercial-gitlab-cng-ee-19.1 | 0 |
| PyPI | aiohttp | 2.0.0 |
| chainguard | py3.13-scanner-test-libraries-aiohttp | 0 |
| PyPI | aiohttp | |
| chainguard | litellm-fips | 0 |
| chainguard | kserve | 0 |
Timeline
- Oct 19, 2026 Coalition ESS Score
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg x_refsource_CONFIRM
- https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09 x_refsource_MISC
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-111066 advisory
- https://github.com/advisories/GHSA-9xw5-w5jj-pvcg advisory