AIOHTTP's connection pool management uses the Max-Age header to determine when to close idle connections. Prior to version 3.14.4, an arithmetic overflow in this logic can cause the pool to retain connections indefinitely, allowing an attacker to send specially crafted requests that drain the entire pool. Exhaustion of the pool prevents new connections from being established until the garbage collector reclaims the stuck connections, resulting in a temporary denial of service for legitimate traffic. The weakness is classified as CWE‑770, indicating a resource depletion flaw.

The flaw affects the aio-libs aiohttp library in any version earlier than 3.14.4. Systems that embed or import aiohttp as a dependency, such as asynchronous Python web servers, client applications, or microservice frameworks that rely on aiohttp for HTTP communication, are potentially impacted. Upgrading to 3.14.4 or later resolves the issue.

The CVSS base score of 6.9 represents moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation yet. However, the attack vector is likely accessible from any external HTTP client that can send requests to the service. An attacker with network access can repeatedly issue requests with crafted Max‑Age values to fill the connection pool and cause temporary service disruption until garbage collection occurs.