The keepalive timeout was not used during the initial portion of a request.

An attacker could keep an idle connection open indefinitely before sending any data.

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.