CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests
Summary
An attacker can exhaust file descriptors with specially crafted multipart requests.
Impact
If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
AIOHTTPto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using aiohttp versions 2.0.0 through versions before 3.14.4 are affected if a request handler calls Request.post() to process multipart requests. The vulnerable endpoint must be reachable by an attacker for remote exploitation.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can send specially crafted multipart requests, and no user interaction is required.
What is the practical impact of a successful attack?
Multipart processing can retain an unbounded number of open file descriptors. An attacker can exhaust the process or host file-descriptor limit, causing availability impact.
What is the remediation?
Upgrade aiohttp to version 3.14.4, which fixes the issue.