AIOHTTP, a popular asyncio-based HTTP framework, contains a flaw that allows an unauthenticated attacker to exhaust a server’s file descriptors. When a handler processes multipart requests via Request.post(), the library can retain an unbounded number of open file descriptors. This resource exhaustion can saturate the operating system’s FD limit, leading to application crashes or denial‑of‑service for legitimate traffic. The weakness is aligned with CWE‑400 and CWE‑770.

All installations of aio‑libs’ aiohttp from version 2.0.0 up to and including 3.14.3 are vulnerable. The fix is incorporated in version 3.14.4 and later. Any Python application that imports aiohttp and uses multipart request handling without limiting the number of concurrent file descriptors may be affected.

The CVSS score of 8.2 classifies this issue as high severity. Although EPSS data is not available, the flaw permits remote exploitation through crafted multipart HTTP POST requests, meaning an attacker only needs internet connectivity to a server using a vulnerable aiohttp version. The vulnerability is not listed in CISA's KEV catalog, but the high severity and potential for widespread impact warrant immediate attention. No special privileges are required; the attacker does not need authentication, and exploitation does not require additional host compromise.