CVE-2026-111065
Received Received - Intake

Max-Age Header Overflow in AIOHTTP Connection Pool

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111065
EUVD
EUVD-2026-104481

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the aiohttp library versions before 3.14.4. It involves a Max-Age processing overflow in cookie handling that prevents connections from being closed properly. An attacker can exploit this to temporarily exhaust the connection pool until garbage collection resolves the lingering connections.

Detection Guidance

Check the installed version of aiohttp using pip show aiohttp. If the version is <=3.14.3, the system is vulnerable. Monitor connection pool exhaustion or unusual connection leaks in application logs.

Impact Analysis

An attacker could exploit this to temporarily exhaust the connection pool, causing service disruptions or degraded performance for applications using affected versions of aiohttp. This may lead to denial-of-service conditions until connections are garbage collected.

Compliance Impact

This vulnerability may lead to temporary exhaustion of connection pools due to improperly closed connections, which could impact system availability and resource management. For compliance with standards like GDPR or HIPAA, which require robust data handling and system reliability, such disruptions could pose risks if they affect the availability or integrity of sensitive data processing.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later using pip install --upgrade aiohttp. Review and update cookie handling logic if custom implementations exist. Monitor connection pools for abnormal exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111065. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart