aiohttp CVE-2026-111065

Requires the aiohttp CLIENT to send a request to an attacker-controlled or compromised server while using a cookie jar (the default), and that server must return a Set-Cookie response header with a hostile Max-Age value whose magnitude exceeds Python's float range, triggering an OverflowError in update_cookies. Limiting factors that reduce real-world risk: it is exploitable only against aiohttp used as an HTTP client (not the server side); the impact is a TEMPORARY connection-pool exhaustion that self-resolves once garbage collection reclaims the orphaned connections; severity scales with how tight the TCPConnector connection limit is (a small/limit=1 pool is exhausted far faster than a large one); and the victim application must actually fetch from endpoints an attacker can influence. Affected: all aiohttp versions prior to 3.14.4.

This is a genuinely moderate, availability-only issue that should be triaged as routine patching rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 6.9 but with VC:N/VI:N/VA:L - the only impact is a LOW availability hit, and CWE-770 (uncontrolled resource consumption) plus the description confirm the effect is a temporary connection-pool exhaustion that self-heals once garbage collection reclaims the orphaned connections. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability signals are simply absent rather than conflicting. A key nuance the raw vector obscures: this is a CLIENT-side flaw - the 'attacker' is the HTTP server the aiohttp client connects to, so real-world risk depends on whether an application uses aiohttp to fetch from untrusted/attacker-influenced endpoints. PR:N is technically correct (the malicious server needs no credentials on the victim), but exploitation is not a classic server-side remote DoS; it requires the victim client to initiate a request to a hostile server. Net: real but low-urgency - patch in normal cycles.

An application uses the aiohttp client (with its default cookie jar) to make HTTP requests to a server an attacker controls or has compromised. That server returns a Set-Cookie header with a crafted Max-Age value larger than Python's float range, triggering an OverflowError during cookie processing that prevents the connection from being closed and returned to the pool. By serving many such responses, the attacker exhausts the client's bounded connection pool (e.g. TCPConnector limit), temporarily stalling further outbound requests until garbage collection frees the leaked connections. No public exploit identified at time of analysis, though the fix commit includes a functional test reproducing the pool-exhaustion condition.