Key points
- aiohttp versions prior to 3.14.4 are affected by CVE-2026-111064.
- The flaw allows attackers to hold connections open without sending data.
- Version 3.14.4 fixes the missing keepalive timeout handling.
The aiohttp library for Python contains a high-severity vulnerability in versions older than 3.14.4. This flaw affects how the framework manages keepalive timeouts during the start of a request. Attackers can exploit this gap to keep connections open indefinitely, consuming server resources without sending any actual data.
In plain English
Normally, servers close connections that sit idle for too long. In vulnerable versions of aiohttp, this timer does not start until after the initial connection is established. An attacker can open a connection and simply wait. Because the server thinks the connection is active, it does not close it. This allows the attacker to occupy a slot on the server.
The background
The issue is tracked as CVE-2026-111064 with a CVSS score of 8.2. The National Vulnerability Database classifies it as high severity. The weakness is categorized under CWE-770. The aiohttp project is an asynchronous HTTP client and server framework designed for Python’s asyncio library. This specific flaw exists in all versions prior to 3.14.4.
What changes now
The aiohttp maintainers have released version 3.14.4 to address this issue. This update restores proper keepalive timeout handling during the initial phase of a request. Users of the pip package manager should upgrade to this patched version. The GitHub advisory confirms that version 3.14.4 resolves the vulnerability present in versions 3.14.3 and earlier.
Who needs to act first
Security operations teams should prioritize updating systems that face the public internet. These external-facing servers are most vulnerable to connection exhaustion attacks. Start by identifying which applications depend on vulnerable aiohttp versions. Test the update in a staging environment to ensure compatibility. Deploy the fix to production systems after validation. If immediate patching is not possible, configure reverse proxies to enforce strict keepalive limits as a temporary mitigation measure.
What to do and how to stay safe: aiohttp
- Inventory all servers running aiohttp to identify those using versions older than 3.14.4.
- Upgrade to version 3.14.4 or later to apply the vendor-provided fix for the timeout flaw.
- Configure reverse proxies to enforce strict keepalive timeouts if you cannot patch immediately.
- Monitor server connection logs for unusual spikes in idle connections from single sources.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of aiohttp are vulnerable?
All versions prior to 3.14.4 are affected by this keepalive timeout vulnerability.
Is there a fix available?
Yes, version 3.14.4 fixes the issue by implementing proper timeout handling.
How can an attacker exploit this?
Attackers can keep idle connections open indefinitely before sending data, consuming server capacity.
