aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Unauthenticated attackers can drain file descriptors in aiohttp servers via crafted requests, a high-severity flaw patched in version 3.14.4.
Key points
- CVE-2026-111066 allows unauthenticated resource exhaustion in aiohttp versions 2.0.0 through 3.14.3.
- The vulnerability triggers when handlers process multipart requests using Request.post().
- Version 3.14.4 resolves the issue by fixing unbounded file descriptor retention.
An unauthenticated attacker can exhaust file descriptors on Python applications using the aiohttp framework by sending specially crafted multipart requests. This high-severity flaw, tracked as CVE-2026-111066, impacts versions from 2.0.0 up to 3.14.3. According to the National Vulnerability Database, the attack requires no credentials and targets the request processing logic. The resulting resource exhaustion can disrupt service availability for managed infrastructure relying on this asynchronous HTTP client and server framework.
How it unfolded
- A vulnerability was identified in aiohttp's handling of multipart requests, allowing unbounded file descriptor retention.
- The flaw was assigned CVE-2026-111066 and rated high severity with a CVSS score of 8.2.
- The aio-libs project released version 3.14.4 to patch the issue in the Python package ecosystem.
Who is affected
Organizations running Python applications that utilize aiohttp for HTTP server functionality are at risk. The vulnerability specifically affects handlers that use the Request.post() method to process incoming multipart data. According to GitHub advisory GHSA-9xw5-w5jj-pvcg, any installation of aiohttp version 2.0.0 or later, but prior to 3.14.4, is vulnerable. This includes a wide range of web services and APIs built on the asyncio framework that have not yet updated to the patched release.
The fix
The aio-libs project has released version 3.14.4 to address CVE-2026-111066. This update corrects the logic that previously allowed multipart request processing to retain an unbounded number of open file descriptors. Users should upgrade their pip installations of aiohttp to version 3.14.4 or later to mitigate the risk. No other remediation steps are confirmed in the source material.
What made it possible
This incident stems from improper resource management during input processing. When an application accepts multipart data, it must strictly limit how many file handles it keeps open simultaneously. If the code fails to close these handles after reading each part, an attacker can force the system to accumulate them until the operating system limit is reached. Teams usually check whether their request handlers properly release resources regardless of payload size. This weakness typically serves the initial disruption phase of an intrusion, denying service before deeper access is gained.
What to do and how to stay safe: aiohttp
- Audit Python applications to identify those using aiohttp versions prior to 3.14.4.
- Verify that server handlers processing multipart uploads are updated to the patched release.
- Monitor system file descriptor counts for sudden spikes that may indicate exploitation attempts.
- Review access logs for unusual multipart request patterns from unauthenticated sources.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111066?
The National Vulnerability Database rates the severity as high with a CVSS score of 8.2.
Which versions of aiohttp are affected by this flaw?
Versions from 2.0.0 up to, but not including, 3.14.4 are vulnerable.
Is authentication required to exploit this vulnerability?
No, the source material states that an unauthenticated attacker can exploit this issue.
