aiohttp server lacks an initial request/header timeout

影響: pip:aiohttp <= 3.14.3 → 3.14.4

The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

在 GitHub Advisory Database 阅读

2026/10/20 02:08，GitHub Advisory Database 发布了“aiohttp server lacks an initial request/header timeout”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-111064。