Vulnerability GHSA-9xw5-w5jj-pvcg
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 hours ago
October 20, 2026 at 07:52 PM UTC
AIOHTTP: File descriptor exhaustion in multipart requests
2.0.0 - 3.14.3
2.0.0 - 3.14.3
Summary
AIOHTTP: File descriptor exhaustion in multipart requests
Details
Summary
An attacker can exhaust file descriptors with specially crafted multipart requests.
Impact
If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
AIOHTTP: Pure-Python parser request smuggling
0.1 - 3.14.3 GHSA-pqxq-w44r-73xw
0.1 - 3.14.3 GHSA-pqxq-w44r-73xw
High Risk
1 day ago
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
Low Risk
1 day ago
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
High Risk
1 day ago
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
Unknown
2 months ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
0.1 - 3.14.2 PYSEC-2026-3545
0.1 - 3.14.2 PYSEC-2026-3545
Impacted packages
Timeline
Published
7 hours ago
October 20, 2026 at 07:52 PM UTC
Fixed (3.14.4)
15 days ago
October 05, 2026 at 05:38 PM UTC
Last Modified
7 hours ago
October 20, 2026 at 08:00 PM UTC