High severity · published Oct 19, 2026
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
>= 2.0.0, < 3.14.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111066
github.com
https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
github.com
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
github.com
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
7.5
CVE-2026-54278
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup