PyPI/aiohttp CVE-2026-111064: high 8.2

aiohttp server lacks an initial request/header timeout

Action: Upgrade aiohttp to 3.14.4 or later.

pip install aiohttp==3.14.4

Affected

Fixed versions

Sources

• osv: GHSA-5wr8-gcqf-gqf3
• nvd: CVE-2026-111064
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
• https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
• https://github.com/aio-libs/aiohttp
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

CVE-2026-111064 · published 2026-10-19T17:08:04Z · modified 2026-10-19T17:15:04.139404381Z · JSON