## aiohttp server lacks an initial request/header timeout

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-111064
- 公開日時: 2026-10-19T17:08:04.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5wr8-gcqf-gqf3)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5wr8-gcqf-gqf3

影響: pip:aiohttp <= 3.14.3 → 3.14.4
Summary The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.