---
id: CVE-2026-111064
title: aiohttp server lacks an initial request/header timeout
summary: >-
  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.4, keepalive timeout handling is absent during the
  initial portion of a request. An attacker can keep an idle connection open
  indefinitely befo…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-770
  - CWE-772
vendor: aio-libs
product: aiohttp
affected:
  - aiohttp < 3.14.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T15:29:16.694430Z'
published: '2026-10-19'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T15:29:24.279Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111064'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
    label: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
    label: >-
      https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
    label: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111064.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-111064'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555713'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-111064'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111064'
  - url: 'https://github.com/aio-libs/aiohttp'
  - url: 'https://github.com/advisories/GHSA-5wr8-gcqf-gqf3'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00399
epssPercentile: 0.34331
aliases:
  - GHSA-5wr8-gcqf-gqf3
ecosystem: pip
patched:
  - aiohttp 3.14.4
scores:
  cna: 8.2
  vendor: 7.5
ingestedAt: '2026-10-19T17:33:42.441Z'
---

## Overview

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

## Affected

- `aiohttp < 3.14.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-111064)

Affected packages:

- `aiohttp < 3.14.4`

Patched in:

- `aiohttp 3.14.4`

Source: https://osv.dev/vulnerability/GHSA-5wr8-gcqf-gqf3

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · no fix planned: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111064.json)