Vulnerability GHSA-5wr8-gcqf-gqf3
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 hours ago
October 19, 2026 at 05:08 PM UTC
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3
0.1 - 3.14.3
Summary
aiohttp server lacks an initial request/header timeout
Details
Summary
The keepalive timeout was not used during the initial portion of a request.
Impact
An attacker could keep an idle connection open indefinitely before sending any data.
Workaround
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 hours ago
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
High Risk
4 hours ago
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
Unknown
2 months ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
0.1 - 3.14.2 PYSEC-2026-3545
0.1 - 3.14.2 PYSEC-2026-3545
Unknown
2 months ago
AIOHTTP: HTTP request smuggling via WebSocket upgrade
0.1 - 3.14.1 PYSEC-2026-3546
0.1 - 3.14.1 PYSEC-2026-3546
Unknown
2 months ago
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
0.1 - 3.14.1 PYSEC-2026-3547
0.1 - 3.14.1 PYSEC-2026-3547
Impacted packages
Timeline
Published
4 hours ago
October 19, 2026 at 05:08 PM UTC
Fixed (3.14.4)
14 days ago
October 05, 2026 at 05:38 PM UTC
Last Modified
3 hours ago
October 19, 2026 at 05:15 PM UTC