Executive brief
AIOHTTP is a popular Python library used to build web servers and handle network requests. A flaw in how it handles interrupted connections can cause the server to keep files or other system resources open longer than necessary. An attacker could potentially exploit this to slow down or temporarily crash the service by exhausting available system resources.
Technical details
AIOHTTP prior to version 3.14.1 contains a resource management vulnerability (CWE-404). When a remote client disconnects in the middle of a write operation, the framework fails to correctly close payload resources, such as open file handles. An attacker can exploit this by repeatedly initiating and then terminating connections during data transfer, leading to temporary resource starvation until the Python garbage collector eventually releases the handles. This issue is resolved in version 3.14.1.
Affected products
- aio-libs aiohttp < 3.14.1
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date
- 2026-06-22: patched: Fix released in version 3.14.1