{"id":"CVE-2026-111065","aliases":["GHSA-6cjc-53gc-5rqm"],"title":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","summary":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.4"],"patched":["aiohttp 3.14.4"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T20:15:05.286053785Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6cjc-53gc-5rqm","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111065"},{"url":"https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"},{"url":"https://github.com/advisories/GHSA-6cjc-53gc-5rqm"}],"tags":["osv","pip","ghsa","cve.org"],"epss":0.00395,"epssPercentile":0.33582,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T17:34:44.525014Z"},"cvssSource":"cna","cwe":["CWE-770"],"ingestedAt":"2026-10-19T17:33:42.457Z","slug":"CVE-2026-111065","body":"## Overview\n\n### Summary\n\nAn overflow in Max-Age processing can skip closing a connection.\n\n### Impact\n\nAn attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.\n\n## Affected packages\n\n- `aiohttp < 3.14.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.4`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}