PyPI/aiohttp CVE-2026-111065: medium 6.9

AIOHTTP: Connector pool exhaustion via Max-Age overflow

Action: Upgrade aiohttp to 3.14.4 or later.

pip install aiohttp==3.14.4

Affected

Fixed versions

Sources

• osv: GHSA-6cjc-53gc-5rqm
• nvd: CVE-2026-111065
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm
• https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805
• https://github.com/aio-libs/aiohttp
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

CVE-2026-111065 · published 2026-10-20T19:57:24Z · modified 2026-10-20T20:15:05.286053785Z · JSON