GHSA-5wr8-gcqf-gqf3: Pip/aiohttp vulnerability
Summary
The keepalive timeout was not used during the initial portion of a request.
Impact
An attacker could keep an idle connection open indefinitely before sending any data.
Workaround
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Compensating control
Place the affected service behind a reverse proxy and configure sensible keepalive limits to prevent idle connections from remaining open indefinitely.
Event History
Frequently Asked Questions
Who is exposed to this issue?
aiohttp deployments that accept inbound connections are exposed during the initial phase of a request, before the client sends any data. An attacker can hold such a connection idle indefinitely.
What does an attacker need to do to exploit it?
The attacker only needs to establish a connection and refrain from sending request data. The keepalive timeout does not limit this initial idle period.
What can be done if patching is not immediately possible?
Place the application behind a reverse proxy with sensible keepalive limits. This is also recommended for production deployments.