Every CVE Search/ Get API key

CVE-2026-111064

aiohttp server lacks an initial request/header timeout

8.2 HighFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Unchanged since Oct 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

aiohttp server lacks an initial request/header timeout

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
CVE-2026-111064
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-104480 8.2

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
EUVD-2026-104480
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5wr8-gcqf-gqf3 8.2

aiohttp server lacks an initial request/header timeout

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

Record
GHSA-5wr8-gcqf-gqf3
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
NVD 8.2

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
CVE-2026-111064
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
OSV 8.2

aiohttp server lacks an initial request/header timeout

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
CVE-2026-111064
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-04
OSVDEBIAN-CVE-2026-111064 8.2

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
DEBIAN-CVE-2026-111064
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 12 moreShow less
OSVGHSA-5wr8-gcqf-gqf3 8.2

aiohttp server lacks an initial request/header timeout

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

Record
GHSA-5wr8-gcqf-gqf3
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
OSVOESA-2026-4558 8.2

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.(CVE-2026-111063)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.(CVE-2026-111064)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.(CVE-2026-111065)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.(CVE-2026-111066)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.(CVE-2026-111748)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.(CVE-2026-111749)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.(CVE-2026-111750)

Record
OESA-2026-4558
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4559 8.2

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.(CVE-2026-111063)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.(CVE-2026-111064)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.(CVE-2026-111065)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.(CVE-2026-111066)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.(CVE-2026-111748)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.(CVE-2026-111749)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.(CVE-2026-111750)

Record
OESA-2026-4559
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4560 8.2

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.(CVE-2026-111063)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.(CVE-2026-111064)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.(CVE-2026-111065)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.(CVE-2026-111066)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.(CVE-2026-111748)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.(CVE-2026-111749)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.(CVE-2026-111750)

Record
OESA-2026-4560
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-111064 8.2

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
UBUNTU-CVE-2026-111064
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-109887 No score

CVE-2026-111064 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Record
AZL-109887
Updated
2026-11-05
OSVCLSA-2026-1792478786 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post17+tuxcare.

Record
CLSA-2026-1792478786
Updated
2026-11-02
OSVCLSA-2026-1792482252 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.5.post20+tuxcare.

Record
CLSA-2026-1792482252
Updated
2026-11-02
OSVCLSA-2026-1792483828 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post17+tuxcare.

Record
CLSA-2026-1792483828
Updated
2026-11-02
OSVCLSA-2026-1792491379 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post18+tuxcare.

Record
CLSA-2026-1792491379
Updated
2026-11-02
OSVCLSA-2026-1793016621 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.10.11.post2+tuxcare.

Record
CLSA-2026-1793016621
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-111064 No score

CVE-2026-111064 in aiohttp - Patched by Root

Root has patched CVE-2026-111064 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-111064
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 through 3.14.3
3.14.4
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.6 up to 3.8.6.post17+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post10+tuxcare3.8.6.post11+tuxcare3.8.6.post12+tuxcare3.8.6.post13+tuxcare
Show 11 moreShow less
3.8.6.post14+tuxcare3.8.6.post15+tuxcare3.8.6.post16+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare
3.8.6.post17+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.5 up to 3.8.5.post20+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post12+tuxcare3.8.5.post13+tuxcare
Show 14 moreShow less
3.8.5.post14+tuxcare3.8.5.post15+tuxcare3.8.5.post16+tuxcare3.8.5.post17+tuxcare3.8.5.post18+tuxcare3.8.5.post19+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post20+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.4 up to 3.8.4.post17+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post10+tuxcare3.8.4.post11+tuxcare3.8.4.post12+tuxcare3.8.4.post13+tuxcare
Show 11 moreShow less
3.8.4.post14+tuxcare3.8.4.post15+tuxcare3.8.4.post16+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare3.8.4.post8+tuxcare3.8.4.post9+tuxcare
3.8.4.post17+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.1 up to 3.8.1.post18+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post13+tuxcare
Show 12 moreShow less
3.8.1.post14+tuxcare3.8.1.post15+tuxcare3.8.1.post16+tuxcare3.8.1.post17+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare
3.8.1.post18+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.10.11 up to 3.10.11.post2+tuxcare, plus listed versions
3.10.11.post1+tuxcare
3.10.11.post2+tuxcare
python-aiohttp
Debian:12
 All versions, plus listed versions
3.10.0-13.10.1-13.10.10-13.10.10-23.10.11-1
Show 29 moreShow less
3.10.3-13.10.3-23.10.3-33.10.4-13.10.5-13.10.6-13.10.8-13.11.15-13.11.16-13.12.15-13.13.0-13.13.1-13.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-13.8.4-13.8.4-1+deb12u13.8.5-13.8.6-13.9.1-13.9.5-1
 None known
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 All versions, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-1
Show 10 moreShow less
3.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
Show 12 moreShow less
Affected packages
PackageAffectedFixed
aiohttp
PyPI
 before 3.14.4, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.14.4
python-aiohttp
openEuler:24.03-LTS-SP4
From an advisory covering 7 CVEs
 before 3.14.3-2.oe2403sp4
3.14.3-2.oe2403sp4
python-aiohttp
openEuler:24.03-LTS-SP1
From an advisory covering 7 CVEs
 before 3.14.3-2.oe2403sp1
3.14.3-2.oe2403sp1
python-aiohttp
openEuler:24.03-LTS-SP3
From an advisory covering 7 CVEs
 before 3.14.3-2.oe2403sp3
3.14.3-2.oe2403sp3
aiohttp
Root:PyPI
 before 3.14.3+aikido.1
3.14.3+aikido.13.14.0+aikido.63.8.6+aikido.15
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:26.10
 All versions, plus listed versions
3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111064 is a high vulnerability (CVSS 8.2) in Aio-libs Aiohttp, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in aiohttp 3.14.4.

References

Show 13 moreShow less
This page doesn't list everything

Left out here: 260 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open