Is CVE-2026-111065 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111065 being exploited in the wild.

How severe is CVE-2026-111065?

Medium severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

Is there a fix for CVE-2026-111065?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111065 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111065?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111065: aiohttp cookie Max-Age integer overflow causes connection pool exhaustion

Q: Is there a fix for CVE-2026-111065?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-111065 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-111065?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111065 · Severity: medium · CVSS 4 · Published 2026-10-19

aiohttp is a Python framework for building asynchronous web applications and HTTP clients. A flaw in cookie Max-Age processing can cause integer overflow, leaving connections open and exhausting the connection pool until garbage collection runs. An attacker can temporarily deny service by rapidly triggering this condition.

Technologies: Aio-Libs Aiohttp, aiohttp (PyPI). Vendors: Aio-Libs, PyPI.

Quick answers

Is CVE-2026-111065 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111065 being exploited in the wild.
How severe is CVE-2026-111065?: Medium severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Aio-Libs Aiohttp before 3.14.4; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.
Is there a fix for CVE-2026-111065?: Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111065 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111065?: Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.14.4 or later
```
pip install "aiohttp>=3.14.4"
```

Technical details

An integer overflow in the Max-Age cookie attribute parser causes improper connection lifecycle management, leaving sockets open rather than closing them. The vulnerability is reachable via HTTP responses with malformed Max-Age values and results in temporary connection pool exhaustion; affected connections are eventually reclaimed by garbage collection. The issue is fixed in version 3.14.4.

Affected products

aio-libs aiohttp before 3.14.4

Identifiers

CVE-2026-111065
GHSA-6cjc-53gc-5rqm

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.