En bref
- CVE-2026-111065 est une vulnérabilité MOYENNE (CVSS 6.9) touchant aiohttp.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.40%, plus élevée que 33.8% des vulnérabilités.
- Correctif : mettre à jour vers 3.14.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free