aiohttp CVE-2026-111066

The target application must expose at least one HTTP handler that calls aiohttp's Request.post() to parse multipart/form-data request bodies; this is the exact code path (per-part temporary file creation in web_request.py) that leaks file descriptors. Affected versions are aiohttp from 2 up to but not including 3.14.4. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any internet-facing endpoint meeting the above is reachable by unauthenticated remote attackers. Limiting factors that reduce real-world exposure: the AT:P attack requirement means services that never accept multipart uploads, or that parse bodies without Request.post() (e.g. streaming/multipart reader APIs), are not exploitable; impact is confined to availability of the affected worker process with no data exposure.

This is a genuine but bounded availability risk, best triaged as a medium-high operational priority rather than an emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 and confirms a network-reachable, unauthenticated, low-complexity attack with no user interaction, but the impact is strictly availability (VA:H; VC:N/VI:N/VA via resource exhaustion, CWE-400) - there is no confidentiality or integrity exposure and no scope change to other systems. The single most important mitigating signal is AT:P (attack requirements present): exploitation is only possible against endpoints whose handler actually calls Request.post() to parse multipart bodies, so this is NOT a blanket flaw in every aiohttp deployment. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was supplied, so exploitation status is: no public exploit identified at time of analysis. Conflicting/missing-data note: EPSS is absent, so probabilistic exploitation likelihood cannot be weighed; the high CVSS (8.2) is driven entirely by easy reachability plus total availability loss, not by breadth of impact, so teams running aiohttp services that accept multipart uploads via Request.post() should patch promptly while those that do not are effectively unaffected.

An unauthenticated attacker repeatedly sends specially crafted multipart/form-data requests - bodies composed of many small file parts - to an aiohttp endpoint whose handler calls Request.post(). Each part causes a temporary file descriptor to be opened and retained, so the descriptors accumulate without bound until the worker process hits its file-descriptor limit and can no longer serve requests, producing a denial of service. No public exploit code was identified in the provided intelligence; the attack is simple to construct given the low complexity (AC:L) and no required authentication (PR:N).