Vdirsyncer versions from 0.19.0 up to but not including 0.21.0_2 have a vulnerability where the aiohttp server does not enforce an initial request or header timeout. This allows an attacker to keep an idle connection open indefinitely before sending any data. The issue is fixed in version 0.21.0_2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.