aiohttp: Denial of service through missing timeout before the first request
Summary
aiohttp, an asynchronous HTTP client and server framework for Python, does not apply its keepalive timeout to the start of a request. A remote attacker can keep an idle connection open indefinitely without sending any request data, which consumes server connection capacity. The issue affects aiohttp servers reachable over the network; client-only use is not affected by this server-side behaviour.
Affected
- aiohttp versions before 3.14.4 (aio-libs aiohttp, per CNA record)
Fixed in
- Upgrade to aiohttp 3.14.4 or later.
Workaround
- Place a reverse proxy with sensible keepalive and connection limits in front of aiohttp servers, as recommended by the vendor advisory.
- Limit simultaneous connections at the proxy or firewall as an interim measure (effect not verified).
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
Our recommendation
- Inventory Python services and check whether aiohttp runs in server mode.
- Upgrade server-side aiohttp instances to 3.14.4 or later after testing.
- For internet-facing services that cannot be upgraded soon, place a reverse proxy with keepalive and connection limits in front of them.
- Monitor connection counts for unusually many idle connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5wr8-gcqf-gqf3 github.com
- Fix commit be84682 (Close idle connections) github.com
- aiohttp release 3.14.4 github.com
- OSV entry GHSA-5wr8-gcqf-gqf3 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:42.
Original description (NVD)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.