{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aaio-libsaiohttp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aio-libs:aiohttp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-111066"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["aiohttp (\u003e= 2.0.0, \u003c 3.14.4)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","webserver","vulnerability"],"_cs_type":"advisory","_cs_vendors":["aio-libs"],"content_html":"\u003cp\u003eThe aiohttp library (versions 2.0.0 through 3.14.3) is susceptible to a resource exhaustion vulnerability (CVE-2026-111066) due to improper management of file descriptors during the processing of multipart requests. An unauthenticated attacker can exploit this by submitting specifically crafted multipart HTTP requests to an application that utilizes the Request.post() method.\u003c/p\u003e\n\u003cp\u003eWhen processed, the library fails to properly throttle or limit the number of file descriptors created on behalf of the request, allowing an attacker to exhaust the operating system's file descriptor limits. This leads to a denial-of-service (DoS) condition where the affected application becomes unresponsive or unable to handle new network connections or file operations. Defenders should prioritize updating to aiohttp 3.14.4 or later to implement the necessary resource constraints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an internet-facing application that uses the aiohttp library for handling HTTP multipart/form-data uploads.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request containing an excessive number of multipart parts or specific header values designed to trigger the vulnerable code path in Request.post().\u003c/li\u003e\n\u003cli\u003eThe target application receives the malicious request and initiates the parsing process within the aiohttp multipart handler.\u003c/li\u003e\n\u003cli\u003eThe library allocates file descriptors for each part of the multipart request without enforcing per-request limits.\u003c/li\u003e\n\u003cli\u003eThe attacker sustains the transmission of these requests to rapidly increase the count of open file descriptors associated with the application process.\u003c/li\u003e\n\u003cli\u003eThe application process reaches the operating system's configured maximum file descriptor limit (ulimit).\u003c/li\u003e\n\u003cli\u003eThe application service crashes or becomes unresponsive to legitimate users, resulting in a successful denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unavailability of the web service. This vulnerability impacts any system utilizing aiohttp 2.0.0 through 3.14.3 to process multipart requests, potentially affecting a wide array of web services, internal APIs, and microservices. Because the attack requires no authentication and low complexity, it presents a significant risk for service disruption in environments exposed to untrusted network traffic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the aiohttp package to version 3.14.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web server error logs for persistent \u0026quot;too many open files\u0026quot; or \u0026quot;OSError: [Errno 24] Too many open files\u0026quot; messages, which may indicate active exploitation or resource exhaustion.\u003c/li\u003e\n\u003cli\u003eReview network edge configurations to implement rate limiting on POST requests directed at multipart/form-data endpoints.\u003c/li\u003e\n\u003cli\u003eUse system-level telemetry to monitor file descriptor usage per application process, specifically for services using the affected aiohttp versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:55:48Z","date_published":"2026-10-20T23:55:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aiohttp-file-descriptor-exhaustion/","summary":"An unauthenticated remote attacker can trigger a denial-of-service condition by sending specially crafted multipart requests that cause uncontrolled file descriptor allocation in the aiohttp library.","title":"AIOHTTP: File descriptor exhaustion via multipart requests (CVE-2026-111066)","url":"https://feed.craftedsignal.io/briefs/2026-10-aiohttp-file-descriptor-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:aio-Libs:aiohttp:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}