aiohttp server lacks an initial request/header timeout

影響: pip:aiohttp <= 3.14.3 → 3.14.4

The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

GitHub Advisory Databaseで読む

2026/10/20 02:08、GitHub Advisory Databaseが「aiohttp server lacks an initial request/header timeout」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-111064。