CVE-2026-111064: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111064 is a Denial of Service vulnerability in the AIOHTTP asynchronous HTTP client/server framework for Python, caused by missing keepalive timeout enforcement during the initial phase of a connection. Prior to version 3.14.4, an unauthenticated attacker could establish a TCP connection and hold it open indefinitely without sending any request data, consuming server connection capacity. All aiohttp versions up to and including 3.14.3 are affected. The vulnerability was published on October 7, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (Github Advisory, Feedly).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-772 (Missing Release of Resource after Effective Lifetime). In aiohttp's RequestHandler (in web_protocol.py), the _keepalive flag was initialized to False and the keepalive timeout was only armed after the first request was received — meaning a newly accepted connection that never sent any data was never subject to any timeout. The fix (commit be84682) initializes _keepalive to True and arms the keepalive timer immediately upon connection_made(), so idle connections that never deliver a complete request are closed after keepalive_timeout seconds. Additionally, the patch ensures that connections trickling partial header bytes do not extend the first-request deadline (Github Advisory, Patch Commit).

Successful exploitation results in a Denial of Service against the aiohttp server: an attacker can exhaust the server's available connection slots by holding many idle connections open indefinitely, preventing legitimate clients from establishing new connections. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Services directly exposed to the internet without a reverse proxy are most at risk, as a sufficiently large number of idle connections can render the application unresponsive (Github Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time (Feedly). The vulnerability is unauthenticated and requires no user interaction, making it trivially automatable — an attacker simply needs to open many TCP connections to the target port and refrain from sending data. The EPSS score is 0.0, reflecting the current absence of observed exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing services running aiohttp versions ≤ 3.14.3 using tools such as Shodan or Censys, searching for Python/aiohttp server banners on common HTTP ports (80, 443, 8080).
2. Establish idle connections: Open a large number of TCP connections to the target aiohttp server port (e.g., using socket in Python, netcat, or a scripted tool like hping3) without sending any HTTP request data.
3. Hold connections open: Keep each connection alive by not sending any bytes, exploiting the absence of an initial keepalive timeout. The server will maintain each connection in its connection table indefinitely.
4. Exhaust connection capacity: Repeat until the server's connection limit (governed by OS socket backlog and application-level limits) is saturated, causing new legitimate connection attempts to be refused or queued indefinitely.
5. Denial of Service achieved: Legitimate clients are unable to connect to the aiohttp service, resulting in service unavailability (Github Advisory, Patch Commit).

• Network: Large number of established TCP connections to the aiohttp server port from one or more source IPs with no corresponding HTTP request traffic; connections remaining in ESTABLISHED state for extended periods without data transfer.
• Logs: Absence of HTTP access log entries for connections that are visible in OS-level connection tables (netstat, ss); aiohttp server logs showing high connection counts with no corresponding request processing.
• Process/OS: Elevated open file descriptor count for the aiohttp process (/proc/<pid>/fd); ss -tn state established showing many connections to the service port with zero bytes sent by the remote peer; system resource exhaustion alerts related to socket/connection limits.

The primary remediation is to upgrade aiohttp to version 3.14.4 or later, which applies the keepalive timeout from the moment a connection is accepted, closing idle connections that never deliver a complete request (Github Advisory, Release Notes). As a workaround for deployments that cannot immediately upgrade, place the aiohttp server behind a reverse proxy (e.g., nginx, HAProxy) configured with sensible keepalive and connection timeout limits — this is already recommended practice for all production aiohttp deployments. Additionally, network-level controls such as firewall rate limiting on new TCP connections per source IP can reduce the attack surface.

The vulnerability was reported by researcher tatulea and remediated by Dreamsorcerer, the primary aiohttp maintainer, who published the GitHub Security Advisory (GHSA-5wr8-gcqf-gqf3) on October 7, 2026 (Github Advisory). Red Hat tracked the issue via Bugzilla (Bug #2555713) and published a CVE advisory, indicating downstream Linux distribution awareness. No significant broader media coverage or notable social media discussion beyond standard CVE feed announcements was observed.