---
id: CVE-2026-111064
aliases:
  - GHSA-5wr8-gcqf-gqf3
title: aiohttp server lacks an initial request/header timeout
summary: aiohttp server lacks an initial request/header timeout
severity: high
cvss: 8.2
cwe:
  - CWE-770
vendor: aiohttp
product: aiohttp
ecosystem: pip
affected:
  - aiohttp <= 3.14.3
patched:
  - aiohttp 3.14.4
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T17:08:05Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5wr8-gcqf-gqf3'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
  - url: 'https://github.com/advisories/GHSA-5wr8-gcqf-gqf3'
tags:
  - ghsa
  - pip
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
ingestedAt: '2026-10-19T17:33:42.441Z'
---

## Overview

### Summary

The keepalive timeout was not used during the initial portion of a request.

### Impact

An attacker could keep an idle connection open indefinitely before sending any data.

### Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

## Affected packages

- `aiohttp <= 3.14.3`

## Remediation

Upgrade to a patched release:

- `aiohttp 3.14.4`