CVE-2026-111064

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

In aiohttp before 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can smuggle requests when an application runs without a standard wheel (e.g., with AIOHTTP_NO_EXTENSIONS) and an intermediary interprets the framing differently.

In AIOHTTP prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user accessing an untrusted subdomain may have host-only protections stripped from cookies.

In aiohttp before 3.14.4, an attacker can send an absolute-form request causing Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications using Request.scheme for security decisions can be tricked about whether the connection is encrypted.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

In aiohttp before 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can temporarily exhaust the connection pool until garbage collection resolves the connections.

In aiohttp before 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can cause a shared cookie marked Secure to be sent with an unencrypted request.

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.