CVE-2026-111066
Received Received - Intake

AIOHTTP Multipart Request File Descriptor Exhaustion

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111066
EUVD
EUVD-2026-104482

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp >= 2.0.0, < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AIOHTTP allows an unauthenticated attacker to exhaust system file descriptors by sending specially crafted multipart requests. The issue occurs when a handler uses Request.post() in versions 2.0.0 to 3.14.4. The framework retains an unbounded number of open file descriptors during multipart request processing, leading to potential denial-of-service conditions.

Detection Guidance

Monitor file descriptor usage during multipart request processing. Check for unusually high open file descriptors with commands like 'lsof -p <PID>' or 'ss -s'. Logs may show excessive temporary file creation. Use 'strace' to trace file operations during requests.

Impact Analysis

An attacker could exploit this to consume all available file descriptors on a system, causing denial-of-service by preventing legitimate processes from opening files. Systems using vulnerable AIOHTTP versions for HTTP servers or clients may become unresponsive or crash under crafted multipart requests.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later. Implement rate limiting for multipart requests. Monitor file descriptor usage and set system limits. Restrict access to endpoints handling multipart requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart