https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T12:22:58.220016+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111064 CVE-2026-111064 — aiohttp server lacks an initial request/header timeout 2026-10-21T12:22:58.224029+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

 https://db.gcve.eu/vuln/ghsa-5wr8-gcqf-gqf3 GHSA-5wr8-gcqf-gqf3 — aiohttp server lacks an initial request/header timeout 2026-10-21T12:22:58.224136+00:00

Affected: PyPI: aiohttp

### Summary

The keepalive timeout was not used during the initial portion of a request.

### Impact

An attacker could keep an idle connection open indefinitely before sending any data.

### Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.