CVE-2026-111064
Received Received - Intake

Keepalive Timeout Handling Flaw in AIOHTTP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111064
EUVD
EUVD-2026-104480

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the AIOHTTP framework before version 3.14.4. It allows an attacker to keep an idle server connection open indefinitely without sending any request data. The server fails to enforce keepalive timeouts during the initial request phase, leading to potential resource exhaustion.

Detection Guidance

Monitor for unusually high numbers of idle connections in your aiohttp server logs or network traffic. Check if connections remain open without any request data being sent. Use tools like netstat or ss to list active connections and their states.

Impact Analysis

An attacker could exploit this to consume server connection capacity, causing denial-of-service conditions. Servers may run out of available connections, leading to degraded performance or crashes. This is especially critical for high-traffic applications.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through resource exhaustion. Uncontrolled idle connections may lead to server overload, disrupting availability of systems handling personal or health data, which is critical under GDPR's availability principle and HIPAA's access control requirements.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later. As a temporary workaround, configure a reverse proxy (e.g., Nginx) with strict keepalive timeout settings to limit idle connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111064. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart