Key points
- CVE-2026-111066 affects aiohttp versions from 2 up to, but not including, 3.14.4.
- The vulnerability allows resource exhaustion of file descriptors via multipart requests.
- Version 3.14.4 contains the fix for this high-severity issue.
The aiohttp library for Python contains a resource exhaustion flaw that impacts versions from 2 up to 3.14.4. According to the National Vulnerability Database, this issue carries a CVSS score of 8.2, classifying it as high severity. The vulnerability stems from how the framework handles multipart requests, specifically when a handler uses Request.post(). An unauthenticated attacker can send specially crafted requests to trigger the bug.
In plain English
When a server receives a multipart request, it typically handles multiple parts of data. In affected versions of aiohttp, the processing logic fails to clean up file descriptors properly. This causes the system to keep an unbounded number of file descriptors open. As these descriptors accumulate, the server eventually runs out of available resources. The result is a denial of service condition where the application can no longer accept new connections or process requests effectively.
The background
Aiohttp is an asynchronous HTTP client and server framework designed for use with asyncio and Python. The flaw is categorized under CWE-400 and CWE-770, relating to resource exhaustion. The issue exists in all releases starting from version 2 until the release of version 3.14.4. The National Vulnerability Database records this as CVE-2026-111066. The description notes that the problem occurs specifically when the multipart request processing retains open descriptors indefinitely.
What changes now
The maintainers have released version 3.14.4 to address this vulnerability. This update fixes the issue where multipart request processing could retain an unbounded number of open file descriptors. Users running any version of aiohttp from 2 up to 3.14.4 must upgrade to the patched release. There is no confirmed fix for versions prior to 3.14.4 other than upgrading to the latest supported version. Teams should verify their current library version immediately.
Who needs to act first
Teams usually prioritize systems that accept unauthenticated multipart uploads from the internet. Check whether your application uses Request.post() to handle these uploads. If so, treat this as a critical update. Roll out the fix to public-facing endpoints first, then internal services. Test the upgrade in a staging environment to ensure compatibility. Back up configurations before applying changes. Monitor file descriptor usage during the rollout to confirm the exhaustion behavior stops.
What to do and how to stay safe: aiohttp
- Identify all Python applications using aiohttp versions prior to 3.14.4.
- Verify if any endpoints process multipart requests using Request.post().
- Upgrade to aiohttp version 3.14.4 to apply the confirmed fix.
- Monitor system file descriptor counts for abnormal increases after deployment.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of aiohttp are affected by CVE-2026-111066?
Versions from 2 up to, but not including, 3.14.4 are affected.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in version 3.14.4.
What is the severity of this vulnerability?
It has a CVSS score of 8.2, which is rated as high.
