DEBIAN-CVE-2026-111066
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-111066
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111066.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-111066
- Upstream
- Published
- 2026-10-20T09:47:32Z
- Modified
- 2026-10-20T10:00:07Z
- Summary
- [none]
- Details
-
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
- References
Affected packages
Debian:12 / python-aiohttp
Package
- Name
- python-aiohttp
- Purl
- pkg:deb/debian/python-aiohttp?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
3.*
3.8.4-1
3.8.4-1+deb12u1
3.8.5-1
3.8.6-1
3.9.1-1
3.9.5-1
3.10.0-1
3.10.1-1
3.10.3-1
3.10.3-2
3.10.3-3
3.10.4-1
3.10.5-1
3.10.6-1
3.10.8-1
3.10.10-1
3.10.10-2
3.10.11-1
3.11.15-1
3.11.16-1
3.12.15-1
3.13.0-1
3.13.1-1
3.13.3-1
3.13.3-2
3.13.3-3
3.13.5-1
3.14.0-1
3.14.1-1
3.14.1-2
3.14.1-3
3.14.1-4
3.14.1-5
3.14.3-1
Debian:13 / python-aiohttp
Package
- Name
- python-aiohttp
- Purl
- pkg:deb/debian/python-aiohttp?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / python-aiohttp
Package
- Name
- python-aiohttp
- Purl
- pkg:deb/debian/python-aiohttp?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected