CVE-2026-111065: AIOHTTP: Connector pool exhaustion via Max-Age overflow
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
AIOHTTPto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using aiohttp versions earlier than 3.14.4 are affected. The issue concerns aiohttp connection-pool handling when processing Max-Age values.
What does an attacker need to do to trigger the issue?
An attacker needs to cause Max-Age processing to overflow, which can prevent aiohttp from closing a connection. The provided information does not identify any authentication or user-interaction requirement.
What is the operational impact?
Connections that should be closed can remain in the pool, allowing an attacker to temporarily exhaust the connection pool. Availability is affected until garbage collection resolves the retained connections.
What should teams do if they cannot patch immediately?
The provided information identifies upgrading to aiohttp 3.14.4 as the fix. It does not provide a documented workaround or configuration-based mitigation for unpatched deployments.