# CVE-2026-111064: aiohttp keepalive timeout enforcement bypass

Source: https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111064 · Severity: high · CVSS 4 · Published 2026-10-19

aiohttp is a widely-used Python framework for building asynchronous web servers. An attacker can hold HTTP connections open indefinitely without sending any request data, exhausting the server's connection capacity and causing a denial-of-service condition for legitimate users.

Technologies: [Aio-Libs Aiohttp](https://junglewise.ai/threats/technologies/aio-libs-aiohttp), [aiohttp (PyPI)](https://junglewise.ai/threats/technologies/aiohttp). Vendors: [Aio-Libs](https://junglewise.ai/threats/vendors/aio-libs), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-111064 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111064 being exploited in the wild.

**How severe is CVE-2026-111064?** High severity, with a CVSS score of 4, published 19 October 2026.

**Which products and versions are affected?** Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

**Is there a fix for CVE-2026-111064?** Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111064 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111064?** Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aiohttp (PyPI): upgrade to 3.14.4 or later

  ```sh
  pip install "aiohttp>=3.14.4"
  ```


## Technical details

The keepalive timeout mechanism in aiohttp does not apply to the initial portion of an HTTP request, allowing an attacker to keep idle connections open without sending request data. An attacker needs only network access to the server to open and hold connections; no authentication or special preconditions are required. This results in connection exhaustion and denial-of-service.

## Affected products

- aio-libs aiohttp before 3.14.4

## Identifiers

- CVE-2026-111064
- GHSA-5wr8-gcqf-gqf3

## Timeline

- 2026-10-05: patched: version 3.14.4 released
- 2026-10-19: disclosed

## References

- [https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3](https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3)
- [https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)

## Related threats

- [AIOHTTP WebSocket memory exhaustion via fragmented frames](https://junglewise.ai/threats/cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp HTTP request smuggling in pure Python parser](https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp host-only cookie scope bypass in subdomain handling](https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp Request scheme manipulation in absolute-form requests](https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [AIOHTTP multipart request file descriptor exhaustion](https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for)