aiohttp users must patch keepalive flaw before servers run out of connections

The aiohttp asynchronous HTTP client and server framework for Python contains a configuration gap in versions older than 3.14.4. According to the National Vulnerability Database, this flaw allows an attacker to maintain an idle connection indefinitely before transmitting any actual request data. This behavior bypasses standard timeout mechanisms, potentially consuming server connection capacity.

How it unfolded

• The vulnerability, tracked as CVE-2026-111064, was identified in the keepalive timeout handling logic within the aiohttp framework.
• Analysis revealed that the timeout was not applied during the initial portion of an HTTP request, leaving connections open without limit.
• The aio-libs project released version 3.14.4 to address the issue, restoring the expected timeout behavior for idle connections.

Who is affected

Any organization running Python applications that utilize the aiohttp library in versions 3.14.3 or earlier is vulnerable. This includes web servers, API endpoints, and microservices built with this asynchronous framework. The vulnerability is classified as high severity with a CVSS score of 8.2. Attackers can exploit this by opening multiple connections and leaving them idle, consuming server connection capacity.

Our take on the response

The vendor has provided a direct fix in version 3.14.4, which is the recommended remediation path. The GitHub advisory also suggests using a reverse proxy with sensible keepalive limits as a workaround for production deployments. This indicates that while the library itself had a gap, architectural defenses like reverse proxies can mitigate the impact. Teams should prioritize updating the library directly, as relying solely on network-level mitigations may not fully protect against resource exhaustion.

Who needs to act first

Managed service providers should immediately identify all client environments running aiohttp versions below 3.14.4. Prioritize systems exposed to the public internet or handling high volumes of concurrent connections, as these face the greatest risk of resource exhaustion. Before deploying the update, test the patch in a staging environment to ensure compatibility with existing applications. If immediate patching is not feasible, configure reverse proxies to enforce strict keepalive timeouts, reducing the window for attackers to hold connections open.

Background: Reverse proxies

A reverse proxy is a server that sits in front of web servers and forwards client requests to them. It hides the identity of the origin server, manages load balancing, and can terminate SSL connections. This setup improves security by shielding internal network details from direct external exposure.

Read the full guide: Reverse Proxies: Meaning, Definition, and Security Mechanics

What to do and how to stay safe

• Inventory all Python applications to identify those using aiohttp versions older than 3.14.4.
• Apply the update to version 3.14.4 as soon as possible to restore proper keepalive timeout handling.
• Configure reverse proxies in front of affected servers to enforce strict keepalive limits as an additional layer of defense.
• Monitor server connection counts and resource usage for signs of unusual idle connections following the patch deployment.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111064?

It is a high-severity vulnerability in aiohttp versions prior to 3.14.4 that allows attackers to keep idle connections open indefinitely.

Which versions of aiohttp are vulnerable?

All versions of the aiohttp library prior to 3.14.4 are affected by this keepalive timeout handling