GitHub Advisoryadvisory · PyPI

GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests

HIGH Published 2026-10-20 Modified 2026-10-20 Official page ↗
Aliases
CVE-2026-111066
Ecosystem
PyPI
Packages
aiohttp
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400, CWE-770
Reviewed
2026-10-20

Affected packages

• PyPI aiohttp: >= 2.0.0, < 3.14.4 → fixed in 3.14.4

Description

Summary An attacker can exhaust file descriptors with specially crafted multipart requests. Impact If a handler uses `Request.post()`, it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.

Related

Alias · CVE (1)

  • CVE-2026-111066 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References