aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4
The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Read on GitHub Advisory Database
| CVE | CVE-2026-111064 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/20/2026, 02:08 AM, GitHub Advisory Database published "aiohttp server lacks an initial request/header timeout" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-111064.