{"id":"ghsa-ghsa-5wr8-gcqf-gqf3","seq":2436,"kind":"advisory","title":"aiohttp server lacks an initial request/header timeout","url":"https://github.com/advisories/GHSA-5wr8-gcqf-gqf3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5wr8-gcqf-gqf3","summary":"影響: pip:aiohttp <= 3.14.3 → 3.14.4\nSummary The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.","severity":"high","techs":["python"],"cves":["CVE-2026-111064"],"tags":["GHSA-5wr8-gcqf-gqf3","aiohttp"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T17:08:04.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}