CVE-2026-111065Medium· 6.9▾ SunlitAIOHTTP: Connector pool exhaustion via Max-Age overflow
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
0.4% → 0.4%
An overflow in Max-Age processing can skip closing a connection.
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
aiohttp < 3.14.4Upgrade to a patched release:
aiohttp 3.14.4Connected by shared product, vendor, weakness, or advisory.
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111063Medium· 6.3AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python