The Pferd aiohttp server versions from 3.4.2 up to but not including 3.10.0 lack an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue has been fixed in version 3.10.0. The vulnerability has a high severity with a CVSS score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.