GHSA-6cjc-53gc-5rqm: Pip/aiohttp vulnerability
Published Oct 20, 2026
·Updated
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
Affected Software
1 affected componentFixes available
pip/aiohttp<=3.14.3
3.14.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Oct 20, 2026
Advisory Published
via GitHub·07:57 PM
Data Sourced
via GitHub·07:57 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the practical impact of successful exploitation?
An attacker may temporarily exhaust the connection pool because affected connections are not closed. Connection availability recovers when garbage collection resolves those connections.
2
What input condition triggers the issue?
The issue is triggered by an overflow during Max-Age processing. The provided information does not specify the exact Max-Age value or request format required.