High severity · published Oct 19, 2026
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.14.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111064
github.com
https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
github.com
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
github.com
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
7.5
CVE-2026-54278
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup