aiohttp 3.14.4 resolves high-severity connection exhaustion vulnerability CVE-2026-111064
Attackers can hold idle connections open indefinitely in versions below 3.14.4, risking server capacity depletion before any request data arrives.
Key points
- CVE-2026-111064 is rated high severity with a CVSS score of 8.2.
- The flaw affects aiohttp versions prior to 3.14.4 due to missing keepalive timeout handling.
- A patched version, 3.14.4, is available for deployment to mitigate the risk.
The asynchronous HTTP framework aiohttp contains a high-severity vulnerability allowing attackers to exhaust server connections. The issue exists in versions below 3.14.4, where keepalive timeout logic fails during the initial request phase.
What happened
A flaw in aiohttp allows an attacker to maintain an idle connection indefinitely before transmitting any request data. The National Vulnerability Database lists this as CVE-2026-111064 with a CVSS score of 8.2. This weakness stems from absent keepalive timeout handling during the initial portion of a request. Consequently, server connection capacity is consumed without productive traffic. The issue is classified under CWE-770. Versions prior to 3.14.4 are affected.
Why it matters
Environments running vulnerable aiohttp versions face potential denial-of-service conditions through connection exhaustion. According to the GitHub advisory, the impact includes indefinite idle connections. This behaviour depletes server connection capacity. Production systems relying on aiohttp for HTTP client or server functions are exposed. The vulnerability involves keeping connections open before sending data. This affects systems using versions below 3.14.4.
Next steps
- Upgrade aiohttp to version 3.14.4 immediately to apply the fix.
- Verify current installations against the vulnerability list for versions below 3.14.4.
- Implement reverse proxy configurations with strict keepalive limits as a workaround.
- Monitor server connection pools for unusual idle states or capacity drops.
Detection notes
Teams usually observe elevated idle connection counts in proxy logs. Look for sustained TCP connections with zero data transfer. Alerts should trigger on prolonged silence after handshake completion. Check whether connection pool saturation correlates with low request rates. Containment moves include resetting idle connections via proxy configuration. Review firewall logs for unusual connection duration patterns. Monitor for resource exhaustion metrics on application servers.
What to do and how to stay safe: aiohttp
- Audit all systems for aiohttp versions below 3.14.4 and schedule updates.
- Configure reverse proxies to enforce strict keepalive timeouts for incoming connections.
- Monitor server connection capacity metrics for anomalies indicating idle hoarding.
- Review access logs for connections that remain open without transmitting request data.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111064?
The vulnerability has a CVSS score of 8.2, classified as high severity.
Which versions of aiohttp are affected?
All versions prior to 3.14.4 are affected by this keepalive timeout flaw.
Is there a workaround before patching?
Using a reverse proxy with sensible keepalive limits is recommended as a workaround.
