CVE-2026-111065 aio-libs CVE debrief

Who should care

Python developers and administrators using AIOHTTP versions prior to 3.14.4 should assess exposure and prioritize upgrading to version 3.14.4 or later. AIOHTTP users who have not upgraded to version 3.14.4 are at risk of temporary connection pool exhaustion and denial of service. Security teams and vulnerability management teams should review the vulnerability and assess the risk to their organization.

Why it matters

CVE-2026-111065 AIOHTTP vulnerability requires attention from Python developers and administrators to prevent potential temporary connection pool exhaustion and denial of service.

• Temporary connection pool exhaustion
• Potential for denial of service
• Need for garbage collection to resolve connections
• Verification of AIOHTTP version and Max-Age settings required

Technical summary

AIOHTTP versions prior to 3.14.4 are vulnerable to connector pool exhaustion via Max-Age overflow. An attacker can cause temporary exhaustion of the connection pool until garbage collection resolves the connections. The vulnerability is caused by the Max-Age processing overflowing and skipping closing a connection. This issue is fixed in version 3.14.4. Python developers and administrators using AIOHTTP versions prior to 3.14.4 should assess exposure and prioritize upgrading to version 3.14.4 or later. The vulnerability requires attention from Python developers and administrators to prevent potential temporary connection pool exhaustion and denial of service.

Defensive priority

Medium priority for Python developers and administrators using AIOHTTP versions prior to 3.14.4

Recommended defensive actions

• Upgrade AIOHTTP to version 3.14.4 or later
• Review and adjust Max-Age settings for AIOHTTP connections
• Monitor connection pool usage and garbage collection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm AIOHTTP vulnerability. Source item and references provide additional context. The CVE record was published on 2026-10-19T16:57:26.696Z and has not been modified since then. The official advisory from AIOHTTP and other sources confirm the vulnerability and provide guidance on mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.