PyPI · aiohttp
aiohttp server lacks an initial request/header timeout
The keepalive timeout was not used during the initial portion of a request.
An attacker could keep an idle connection open indefinitely before sending any data.
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.