AIOHTTP server processes an incoming TCP connection but does not enforce a timeout before any request data arrives. An attacker can open a connection and keep it idle for an unlimited period, causing the server to reserve socket and thread resources for each such connection. This leads to a Denial of Service attack by exhausting the pool of available connections and can result in legitimate traffic being denied. The flaw corresponds to CWE-770 (Exhaustion of Resources).

The vulnerability affects the aio-libs aiohttp framework. All versions of aiohttp released before 3.14.4 are vulnerable. The fix is delivered in release 3.14.4 and later.

The CVSS score of 8.2 indicates high severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker opening an idle TCP connection to the aiohttp server and holding it before sending any request data. This requires no authentication and no elevated privileges, enabling the attacker to consume server connection capacity and potentially cause service interruption.