Snyk agent scan: aiohttp server lacks an initial request/header timeout (CVE-2026-111064)

This vulnerability in aiohttp server versions >=0.4.3 and <0.6.9 involves the absence of an initial request/header timeout, specifically the keepalive timeout was not applied during the initial portion of a request. This allows an attacker to maintain an idle connection indefinitely before sending any data, potentially leading to resource exhaustion or denial of service conditions. The vulnerability is tracked as CVE-2026-111064 and has a CVSS 4.0 vector indicating network attack vector, low attack complexity, partial attack type, no privileges required, no user interaction, no confidentiality, integrity, or availability impact, but high vulnerability age and no scope or security impact changes.

An attacker can keep an idle connection open indefinitely before sending any data, which could lead to resource exhaustion on the server side. There is no direct confidentiality, integrity, or availability impact reported, but the indefinite idle connection could degrade service availability.

A patch is available for this vulnerability. Additionally, using a reverse proxy with sensible keepalive limits is recommended as a workaround, which is also advised for all production deployments. Organizations should apply the official patch or implement the reverse proxy workaround to mitigate this issue.