{"id":"CVE-2026-111064","published":"2026-10-19T17:17:03.377","lastModified":"2026-10-19T20:55:02.217","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3","tags":[]}],"exploitRefs":[{"url":"https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3","tags":[]}],"hasPoc":true,"ai":null}