CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests

Q: Which deployments are exposed to this issue?

Deployments using aiohttp versions 2.0.0 through versions before 3.14.4 are affected if a request handler calls Request.post() to process multipart requests. The vulnerable endpoint must be reachable by an attacker for remote exploitation.

Q: Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can send specially crafted multipart requests, and no user interaction is required.

Q: What is the practical impact of a successful attack?

Multipart processing can retain an unbounded number of open file descriptors. An attacker can exhaust the process or host file-descriptor limit, causing availability impact.

Q: What is the remediation?

Upgrade aiohttp to version 3.14.4, which fixes the issue.

Published Oct 19, 2026

Updated

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

Other sources

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

— NVD

Affected Software

1 affected component

aiohttp aiohttp>=2.0.0<3.14.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade aiohttp to a version that resolves this vulnerability.
Fixed in 3.14.4

Event History

Oct 19, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using aiohttp versions 2.0.0 through versions before 3.14.4 are affected if a request handler calls Request.post() to process multipart requests. The vulnerable endpoint must be reachable by an attacker for remote exploitation.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can send specially crafted multipart requests, and no user interaction is required.

What is the practical impact of a successful attack?

Multipart processing can retain an unbounded number of open file descriptors. An attacker can exhaust the process or host file-descriptor limit, causing availability impact.

What is the remediation?

Upgrade aiohttp to version 3.14.4, which fixes the issue.

CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful attack?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful attack?

What is the remediation?