CVE-2026-111066 — AIOHTTP: File descriptor exhaustion in multipart requests
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file…
Published: 2026-10-19 · CVSS: 8.2 · CVSS 4.0
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7