---
id: CVE-2026-111066
title: 'AIOHTTP: File descriptor exhaustion in multipart requests'
summary: >-
  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. From 2.0.0 until 3.14.4, multipart request processing can retain an
  unbounded number of open file descriptors. An unauthenticated attacker can
  consequently e…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-770
vendor: aio-libs
product: aiohttp
affected:
  - 'aiohttp >= 2.0.0, < 3.14.4'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T17:01:01.884Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111066'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
    label: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
    label: >-
      https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
    label: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
tags:
  - cve.org
ingestedAt: '2026-10-19T17:33:42.455Z'
---

## Overview

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

## Affected

- `aiohttp >= 2.0.0, < 3.14.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.