要点
- CVE-2026-111065 是影响 aiohttp 的中危 (CVSS 6.9)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.40%，高于 33.8% 的漏洞。
- 修复：升级到 3.14.4 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free