The aiohttp server component in Lexicon versions >=3.25.2_3 and <3.25.2_5 lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue has been fixed in version 3.25.2_5. The vulnerability has a high severity with a CVSS score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.