Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
Published: 2026-10-19
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via resource exhaustion
Action: Apply Patch
AI Analysis

Impact

AIOHTTP server processes an incoming TCP connection but does not enforce a timeout before any request data arrives. An attacker can open a connection and keep it idle for an unlimited period, causing the server to reserve socket and thread resources for each such connection. This leads to a Denial of Service attack by exhausting the pool of available connections and can result in legitimate traffic being denied. The flaw corresponds to CWE-770 and CWE-772.

Affected Systems

The vulnerability affects the aio-libs aiohttp framework. All versions of aiohttp released before 3.14.4 are vulnerable. The fix is delivered in release 3.14.4 and later.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker opening an idle TCP connection to the aiohttp server and holding it before sending any request data. This requires no authentication and no elevated privileges, enabling the attacker to consume server connection capacity and potentially cause service interruption.

Generated by OpenCVE AI on October 20, 2026 at 06:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update aiohttp to version 3.14.4 or later
  • Configure network devices or firewalls to limit idle connection durations
  • Monitor and constrain connection pool usage to prevent exhaustion

Generated by OpenCVE AI on October 20, 2026 at 06:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout
History

Wed, 28 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Mon, 19 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Aio-libs
Aio-libs aiohttp
Vendors & Products Aio-libs
Aio-libs aiohttp

Mon, 19 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
Title aiohttp server lacks an initial request/header timeout
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aio-libs Aiohttp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T15:29:24.279Z

Reserved: 2026-10-15T12:47:13.665Z

Link: CVE-2026-111064

cve-icon Vulnrichment

Updated: 2026-10-28T15:29:21.442Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-19T17:17:03.377

Modified: 2026-10-28T16:17:01.090

Link: CVE-2026-111064

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-19T16:47:35Z

Links: CVE-2026-111064 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:45:12Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling

  • CWE-772

    Missing Release of Resource after Effective Lifetime