~ / search / GHSA-9xw5-w5jj-pvcg

GHSA-9xw5-w5jj-pvcg

AIOHTTP: File descriptor exhaustion in multipart requests

Source: GitHub Advisory Database (reviewed) High CVE-2026-111066

Packages

EcosystemPackageAffectedFixed in
PyPI aiohttp >= 2.0.0, < 3.14.4 3.14.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handler uses `Request.post()`, it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.

References

External links from the advisory. They lead to third-party sites.