CVE-2026-111066 aio-libs CVE debrief

Who should care

Defenders of systems using AIOHTTP, particularly those using Request.post() handlers, should assess exposure and prioritize verification of AIOHTTP version to prevent potential denial of service through file descriptor exhaustion. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for AIOHTTP deployments, especially in environments where Request.post() handlers are used.

Why it matters

CVE-2026-111066 AIOHTTP vulnerability requires verification of AIOHTTP version and handler usage to prevent potential denial of service through file descriptor exhaustion.

• Potential denial of service through file descriptor exhaustion
• Need to verify AIOHTTP version and handler usage
• Possible impact on system resource availability

Technical summary

AIOHTTP's multipart request processing retains an unbounded number of open file descriptors from version 2.0.0 until 3.14.4. An unauthenticated attacker can exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4, and defenders should prioritize verification of AIOHTTP version and restrict access to vulnerable handlers to prevent potential denial of service through file descriptor exhaustion. Affected systems using Request.post() handlers are at risk and should be assessed for exposure.

Defensive priority

Defenders should prioritize verification of AIOHTTP version and restrict access to vulnerable handlers.

Recommended defensive actions

• Verify AIOHTTP version is 3.14.4 or later
• Restrict access to handlers using Request.post()
• Monitor file descriptor usage
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and fixed version. Evidence is limited to public CVE and NVD information. Defenders should verify AIOHTTP version and handler usage for potential exposure, focusing on systems using Request.post(). Official CVE Program record and NVD detail page offer source-provided metadata and vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.