[Security] Dependabot: aiohttp (HIGH) - aiohttp server lacks an initial request/header timeout #415

Security Vulnerability Details

• Type: Dependabot Alert docs: update OpenWiki #395
• Package: aiohttp
• Severity: HIGH
• Vulnerable Versions: <= 3.14.3
• Patched Version: 3.14.4
• Advisory IDs: GHSA-5wr8-gcqf-gqf3 / CVE-2026-111064
• Alert URL: https://github.com/lgcorzo/mlops-python-package/security/dependabot/395

Summary

aiohttp server lacks an initial request/header timeout

Description

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.

Remediation Steps

1. Upgrade aiohttp to version 3.14.4 or higher in project dependency specifications.
2. Run test suites and lockfile generation to ensure backwards compatibility.
3. Commit and deploy patched dependencies.

#jules