aiohttp idle connection flaw exhausts server capacity; upgrade to 3.14.4 to mitigate CVE-2026-111064

Attackers can exhaust server connection capacity by holding TCP connections open without sending request data. This high-severity vulnerability, tracked as CVE-2026-111064, affects the aiohttp Python framework. The flaw allows an adversary to maintain an idle state indefinitely, bypassing standard timeout mechanisms. This capability enables resource exhaustion attacks against servers relying on the affected library. Managed service providers must verify their environments are not running vulnerable versions.

How it unfolded

• The aiohttp framework processed initial request connections without applying keepalive timeout limits.
• Attackers established connections and remained silent, avoiding the trigger for timeout closures.
• Servers allocated resources to these idle sessions, reducing capacity for legitimate traffic.
• The aio-libs team identified the missing timeout handling in the connection lifecycle.
• Version 3.14.4 was released to enforce proper timeout behaviors during the initial phase.

Who is affected

Organizations using aiohttp versions earlier than 3.14.4 are vulnerable to this connection-hoarding technique. The flaw impacts any Python application utilizing the asynchronous HTTP client/server framework. According to the National Vulnerability Database, the issue stems from absent keepalive timeout handling during the initial portion of a request. This affects production servers exposed to untrusted networks where connection limits are critical.

The fix

The aio-libs project has released version 3.14.4 to address CVE-2026-111064. This update restores proper keepalive timeout enforcement during the initial connection phase. Users should upgrade their pip installations to this patched version immediately. The GitHub advisory confirms that version 3.14.3 and earlier remain vulnerable. Upgrading ensures that idle connections are terminated according to expected timeouts.

What made it possible

This vulnerability arises from incomplete state management in network protocol handling. The weakness occurs when a server accepts a connection but fails to enforce time limits before the first byte of data arrives. Attackers exploit this gap to hold resources hostage without triggering standard application logic. This stage of intrusion serves resource exhaustion, a common precursor to denial-of-service attacks. Teams usually monitor connection queues for abnormal idle durations. Check whether your load balancers or reverse proxies enforce independent timeout policies to mitigate such application-layer gaps.

What to do and how to stay safe: aiohttp

• Audit all Python applications to identify aiohttp versions below 3.14.4.
• Upgrade to version 3.14.4 or later to apply the security patch.
• Configure reverse proxies to enforce strict keepalive limits as a defense-in-depth measure.
• Monitor server connection pools for unusual idle connection accumulation.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111064?

The Common Vulnerability Scoring System rate is 8.2, classified as high severity.

Which aiohttp versions are vulnerable?

All versions prior to 3.14.4 are affected by this keepalive timeout flaw.

Is there a workaround if patching is delayed?

Using a reverse proxy with sensible keepalive limits is recommended for production deployments.