CVE-2026-111064

HighCVSS 8.2/10Last modified Oct 19, 2026

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1110656.9AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip cl CVE-2026-1110668.2AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can re CVE-2026-1110696.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2026-111074.3Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cra CVE-2026-1110748.7In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When pro CVE-2026-1110758.7In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, CVE-2026-1110797.4A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it ver CVE-2026-111088.8Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escala CVE-2026-1110886.5A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.CVE-2026-111096.5Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa CVE-2026-1110907.8A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessa CVE-2026-1110917.8In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration