{"schemaVersion":3,"id":"CVE-2026-111066","aliases":["DEBIAN-CVE-2026-111066","GHSA-9xw5-w5jj-pvcg"],"status":"published","duplicateOf":null,"title":null,"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.","dates":{"published":"2026-10-19T16:59:47.217Z","modified":"2026-10-20T16:10:55.842Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.2,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Pypi","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.00381,"percentile":0.30675,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-20T00:00:00.000Z","score":0.00381,"percentile":0.30675}],"last30":[{"date":"2026-10-20T00:00:00.000Z","score":0.00381,"percentile":0.30675}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"aio-libs","product":"aiohttp","name":"aiohttp","label":"aiohttp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0, < 3.14.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 3.14.4","eol":null,"hubHref":"/vendor/aio-libs/aiohttp"},{"vendor":"debian","product":"python-aiohttp","name":"python-aiohttp","label":"python-aiohttp","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/python-aiohttp","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"PyPI","product":"aiohttp","name":"aiohttp","label":"aiohttp","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/aiohttp","purlType":"pypi","versions":[{"text":"≥ 2.0.0, < 3.14.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 3.14.4","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg","label":"github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg","hostname":"github.com","tags":["X Refsource CONFIRM","WEB"]},{"url":"https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09","label":"github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","label":"github.com/aio-libs/aiohttp/releases/tag/v3.14.4","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-111066","label":"security-tracker.debian.org/tracker/CVE-2026-111066","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066","label":"nvd.nist.gov/vuln/detail/CVE-2026-111066","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/aio-libs/aiohttp","label":"github.com/aio-libs/aiohttp","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-19T16:59:47.217Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-20T16:10:55.842Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T07:17:58.484Z","stale":false,"partial":false}}