CVE-2026-111066

— UNSCOREDpublic exploit available

Published 2026-10-19 · Updated 2026-10-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

Weaknesses

CWE-400, CWE-770

Public exploit & PoC references

https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg

All references

https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100350PoC
UNSCOREDCVE-2026-101896PoC
UNSCOREDCVE-2026-101911PoC
MEDIUMCVE-2026-102821PoC
HIGHCVE-2026-102993PoC
MEDIUMCVE-2026-107166PoC
MEDIUMCVE-2026-108768PoC
MEDIUMCVE-2026-109932PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.