aiohttp multipart flaw triggers resource exhaustion; patch CVE-2026-111066 in 3.14.4

Security operations teams should review Python applications using the aiohttp framework for exposure to CVE-2026-111066. This high-severity vulnerability, rated 8.2 by the National Vulnerability Database, allows unauthenticated attackers to exhaust file descriptors. The flaw exists in versions 2 through 3.14.3 and impacts how the library handles multipart requests.

The risk

The vulnerability stems from how aiohttp processes multipart requests when a handler uses Request.post(). According to the NVD record, the framework can retain an unbounded number of open file descriptors during this process. An attacker sends specially crafted multipart requests to trigger this behavior. This leads to resource exhaustion, effectively denying service to legitimate users.

Who is exposed

Any organization running Python applications that depend on aiohttp versions 2 or higher, but below 3.14.4, is potentially exposed. The framework is widely used for asynchronous HTTP client and server tasks. Applications that accept multipart form data or file uploads via Request.post() are the primary targets for this exploitation path.

Cost and compliance

The National Vulnerability Database classifies this issue under CWE-400 and CWE-770, indicating resource management errors. While the source material does not detail financial impacts or specific compliance breaches, resource exhaustion can lead to service downtime. Organizations must assess their exposure to maintain availability standards and prevent unauthorized disruption of critical web services.

What to watch

Managers should verify the aiohttp version installed in their production environments immediately. Check dependency trees for indirect usage of the vulnerable library. Prioritize updating to version 3.14.4 to mitigate the risk of file descriptor exhaustion and ensure continued service availability for your Python-based web applications.

Signals worth monitoring

Teams usually detect resource exhaustion through spikes in open file handles or system-level limits being reached. Check whether application logs show sudden failures in accepting new connections without corresponding traffic increases. Monitor for increased error rates related to file operations or connection timeouts. Containment moves typically involve restarting affected services to free descriptors and applying rate limiting to incoming multipart requests until patches are deployed.

Background: File upload vulnerabilities

Reject files based on MIME type and content inspection at the server level. Store uploads outside the web root with random filenames. Disable execution permissions for upload directories to prevent code injection.

Read the full guide: Stop File Upload Vulnerabilities with Server-Side Controls

What to do and how to stay safe: aiohttp

• Audit your Python dependency lists to identify if aiohttp version 2 through 3.14.3 is in use.
• Upgrade to aiohttp version 3.14.4 or later once the vendor provides the update.
• Implement rate limiting on endpoints that accept multipart data to reduce attack surface.
• Monitor system file descriptor usage for sudden spikes that indicate resource exhaustion.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of aiohttp are affected by CVE-2026-111066?

Versions 2 through 3.14.3 are affected. The issue is fixed in version 3.14.4.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 8.2, rating it as HIGH severity.

How can an attacker exploit this flaw?

An unauthenticated attacker can send specially crafted multipart requests to exhaust file descriptors.