CVE-2026-111064

{
  "etk_id": "ETK-2026-2073",
  "cve_id": "CVE-2026-111064",
  "display_id": "CVE-2026-111064",
  "ghsa_id": "GHSA-5wr8-gcqf-gqf3",
  "euvd_id": "EUVD-2026-104480",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Connection resource exhaustion in aiohttp request handling",
  "summary": "aiohttp releases before 3.14.4 do not enforce the expected timeout while an inbound request is starting. An attacker able to connect to an affected aiohttp server can hold connections open without sending request data, reducing capacity for legitimate clients.",
  "mitigation": "Upgrade aiohttp to version 3.14.4 or later. Until upgraded, place the service behind a reverse proxy and enforce appropriate connection keepalive limits.",
  "vendor": "pip",
  "product": "aiohttp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.14.3"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.14.4"
      ],
      "package_name": "aiohttp",
      "purl": "pkg:pypi/aiohttp"
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.004,
  "epss_percentile": 0.3273,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 19.101330733333334,
  "t0_at": "2026-10-19T16:47:35.036000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T18:23:15.300648+00:00",
      "days": 0.06643824824074074,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:47:35.036000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T16:47:35.036000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:47:35.036000+00:00",
      "url": "https://github.com/advisories/GHSA-5wr8-gcqf-gqf3"
    }
  }
}