Is CVE-2026-111064 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111064 being exploited in the wild.

How severe is CVE-2026-111064?

High severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

Is there a fix for CVE-2026-111064?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111064 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111064?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111064: aiohttp keepalive timeout enforcement bypass

Q: Is there a fix for CVE-2026-111064?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-111064 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-111064?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111064 · Severity: high · CVSS 4 · Published 2026-10-19

aiohttp is a widely-used Python framework for building asynchronous web servers. An attacker can hold HTTP connections open indefinitely without sending any request data, exhausting the server's connection capacity and causing a denial-of-service condition for legitimate users.

Technologies: Aio-Libs Aiohttp, aiohttp (PyPI). Vendors: Aio-Libs, PyPI.

Quick answers

Is CVE-2026-111064 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111064 being exploited in the wild.
How severe is CVE-2026-111064?: High severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.
Is there a fix for CVE-2026-111064?: Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111064 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111064?: Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.14.4 or later
```
pip install "aiohttp>=3.14.4"
```

Technical details

The keepalive timeout mechanism in aiohttp does not apply to the initial portion of an HTTP request, allowing an attacker to keep idle connections open without sending request data. An attacker needs only network access to the server to open and hold connections; no authentication or special preconditions are required. This results in connection exhaustion and denial-of-service.

Affected products

aio-libs aiohttp before 3.14.4

Identifiers

CVE-2026-111064
GHSA-5wr8-gcqf-gqf3

Timeline

2026-10-05: patched: version 3.14.4 released
2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.