CVE-2026-111064: aiohttp Server Lacks Initial Request/Header Timeout
Summary
CVE-2026-111064: aiohttp server lacks an initial request/header timeout. Affects aiohttp versions < 3.14.4. Fixed in 3.14.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a popular asynchronous HTTP client/server framework for Python, designed to handle web requests efficiently. It supports both client-side and server-side operations, making it a versatile choice for developers building web applications. However, a recent vulnerability has been identified that affects its handling of initial request timeouts, potentially allowing attackers to exploit idle connections.
Vulnerability Detail
The vulnerability arises from the aiohttp server's failure to enforce a keepalive timeout during the initial phase of a request. This oversight allows an attacker to maintain an idle connection indefinitely without sending any data, which could lead to resource exhaustion on the server and denial of service. The lack of a timeout mechanism means that servers may become unresponsive under certain conditions, impacting overall application performance and availability.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.4
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is recommended to use a reverse proxy in front of your aiohttp server. This proxy can enforce sensible keepalive limits, mitigating the risk of idle connections. For example, if you are using Nginx, you can set the keepalive_timeout directive in your configuration file.
Conclusion
The identified vulnerability in aiohttp poses a significant risk due to the lack of an initial request/header timeout, allowing for potential denial of service attacks. It is crucial for developers using aiohttp to update to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of aiohttp up to and including 3.14.3 are affected by this vulnerability.
If exploited, this vulnerability could lead to resource exhaustion on the server, resulting in denial of service and unresponsiveness of the application.
Yes, the permanent fix is to update aiohttp to version 3.14.4 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
