AIKIDO-2026-10654

TL;DR

Response iterators wrapping execute-stream reads reported iterator failures to session cleanup hooks using an exception-only handler, so asyncio cancellation and other base exceptions did not always trigger the same invalidation path as ordinary errors. If an application task was cancelled (e.g., via a dropped client HTTP request), the YDB session was returned to the connection pool without draining the stream. A remote attacker could repeatedly drop connections to systematically poison the connection pool, causing legitimate subsequent callers to receive spurious SessionBusy errors. The patch routes base exceptions through the error hook to properly invalidate the session and prevent connection pool poisoning.