CVE-2026-111064: aiohttp server lacks an initial request/header timeout
Summary
The keepalive timeout was not used during the initial portion of a request.
Impact
An attacker could keep an idle connection open indefinitely before sending any data.
Workaround
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Compensating control
Use a reverse proxy in front of the aiohttp server with sensible keepalive limits.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Servers using aiohttp versions earlier than 3.14.4 are exposed. The issue affects the server side, where idle connections can consume available connection capacity before any request data is sent.
What does an attacker need to do to exploit it?
An attacker needs to establish a connection to the aiohttp server and leave it idle without sending initial request data or headers. They can keep such connections open indefinitely on affected versions.
Is there a fix available?
Yes. The issue is fixed in aiohttp version 3.14.4.