{"id":"CVE-2026-111066","title":"aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)","summary":"A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sendi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","migration_toolkit_for_applications 8","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","discovery 2","enterprise_linux_ai_rhel_ai 3","lightspeed_services_for_ocp","openshift_ai_rhoai","satellite 6","update_infrastructure_4_for_cloud_providers"],"patched":["aiohttp 3.14.4"],"published":"2026-10-19","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:32:18+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111066.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111066.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111066"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555720"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111066"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066"},{"url":"https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa","cve.org"],"epss":0.00412,"epssPercentile":0.3523,"aliases":["GHSA-9xw5-w5jj-pvcg"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:10:15.422610Z"},"scores":{"vendor":7.5,"cna":8.2},"ingestedAt":"2026-10-19T17:33:42.455Z","slug":"CVE-2026-111066","body":"## Overview\n\nA flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sending specially crafted multipart requests, exhausting available file descriptors and causing a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · no fix planned: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111066.json)\n\n**aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-23.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Lightspeed Services for OCP\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNo fix planned:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Lightspeed Services for OCP\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNot affected:\n\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- --- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce strict limits on multipart payload sizes and uploaded part counts in reque…\n\n## Package advisory (CVE-2026-111066)\n\nAffected packages:\n\n- `aiohttp >= 2.0.0, < 3.14.4`\n\nPatched in:\n\n- `aiohttp 3.14.4`\n\nSource: https://osv.dev/vulnerability/GHSA-9xw5-w5jj-pvcg","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":227054,"id":"CVE-2026-111066","ts":1792585046267,"field":"cvss","old":"8.2","new":"7.5"}]}