AZL-109881

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109881.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-109881

Upstream

CVE-2026-111066

Published

2026-10-19T17:17:03Z

Modified

2026-10-28T05:32:21Z

Summary

CVE-2026-111066 affecting package python-aiohttp 3.6.2-3

Details

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111066

Affected packages

Azure Linux:3 / python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/azure-linux/python-aiohttp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.6.2-3

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109881.json"