GHSA-5wr8-gcqf-gqf3
aiohttp server lacks an initial request/header timeout
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
The keepalive timeout was not used during the initial portion of a request.
### Impact
An attacker could keep an idle connection open indefinitely before sending any data.
### Workaround
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
References
External links from the advisory. They lead to third-party sites.