CVE-2026-111064High· 8.2▾ Twilightaiohttp server lacks an initial request/header timeout
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The keepalive timeout was not used during the initial portion of a request.
An attacker could keep an idle connection open indefinitely before sending any data.
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
aiohttp <= 3.14.3Upgrade to a patched release:
aiohttp 3.14.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111066High· 8.2AIOHTTP: File descriptor exhaustion in multipart requests
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111063Low· 6.3AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme