GHSA-6cjc-53gc-5rqm

AIOHTTP: Connector pool exhaustion via Max-Age overflow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-111065

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aiohttp	< 3.14.4	3.14.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.

References

External links from the advisory. They lead to third-party sites.

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm web
https://nvd.nist.gov/vuln/detail/CVE-2026-111065 advisory
https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805 web
https://github.com/aio-libs/aiohttp package
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 web