High severity8.2NVD Advisory· Published Oct 19, 2026

CVE-2026-111064

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Aio Libs/Aiohttpllm-fuzzy
Range: <3.14.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-5wr8-gcqf-gqf3ghsaADVISORY
github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3nvd
github.com/aio-libs/aiohttp/releases/tag/v3.14.4nvd
github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3nvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000