aio-libs/aiohttp · Security
AIOHTTP: File descriptor exhaustion in multipart requests
- GHSA ID
- GHSA-9xw5-w5jj-pvcg
- CVE ID
- CVE-2026-111066
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Summary
An attacker can exhaust file descriptors with specially crafted multipart requests.
Impact
If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-111066 ↗
- https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09 ↗
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 ↗
- https://github.com/advisories/GHSA-9xw5-w5jj-pvcg ↗