CVE-2026-59881 — AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even …
Published: 2026-07-30 · CVSS: 6.9 · CVSS 4.0
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7