En resumen
- CVE-2026-111065 es una vulnerabilidad MEDIO (CVSS 6.9) que afecta a aiohttp.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.40%, mayor que el 33.8% de las vulnerabilidades.
- Solución: actualizar a 3.14.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free