AIKIDO-2026-10284

TL;DR

Affected versions of this package do not enforce strict HTTP server timeout controls, allowing connections to remain open indefinitely and increasing exposure to Slowloris-style denial-of-service attacks. Without properly configured read, header, write, and idle timeouts, an attacker can open numerous concurrent connections and deliberately send partial or slow HTTP requests, exhausting server threads or file descriptors and degrading availability. This can be exploited by maintaining many half-open or slow-drip connections against the agent or connect proxy (including pprof endpoints), ultimately causing resource starvation and service disruption.