AIOHTTP: Connector pool exhaustion via Max-Age overflow

보통 6.9CVE-2026-111065 · GHSA-6cjc-53gc-5rqm · Published 19/10/2026 · updated 19/10/2026

요약

CVE-2026-111065은(는) aiohttp에 영향을 주는 보통 (CVSS 6.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.40%, 전체 취약점의 33.8%보다 높음.
조치: 3.14.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.14.4`	`3.14.4`

Description

Summary

An overflow in Max-Age processing can skip closing a connection.

Impact

An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.