CVE-2026-111065

Summary

AIOHTTP: Connector pool exhaustion via Max-Age overflow

Severity

medium

EPSS

0.4% (p33)

CWE

CWE-770

Also known as

GHSA-6cjc-53gc-5rqm

Published

2026-10-20

Updated

2026-10-20

Advisory details

Summary

An overflow in Max-Age processing can skip closing a connection.

Impact

An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.

References

• https://github.com/advisories/GHSA-6cjc-53gc-5rqm
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm
• https://nvd.nist.gov/vuln/detail/CVE-2026-111065
• https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

Related advisories

• CVE-2026-111066 — high · PyPI/aiohttp
• CVE-2026-111064 — high · PyPI/aiohttp
• GHSA-2g87-pp6c-29x5 — high · PyPI/aiohttp
• CVE-2026-69244 — high · PyPI/aiohttp
• CVE-2026-111748 — medium · PyPI/aiohttp
• CVE-2026-111750 — medium · PyPI/aiohttp
• CVE-2026-69243 — medium · PyPI/aiohttp
• CVE-2026-59881 — medium · PyPI/aiohttp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity