aiohttp server lacks an initial request/header timeout

HOCH 8.2CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3 · Published 19/10/2026 · updated 28/10/2026

Kurz gesagt

CVE-2026-111064 ist eine Schwachstelle (HOCH (CVSS 8.2)) in aiohttp.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.40%, höher als bei 34.2% aller Schwachstellen.
Abhilfe: auf 3.14.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.14.4`	`3.14.4`

Description

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.