AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

MEDIO 6.9CVE-2026-59881 · GHSA-mq44-7p77-q5h7 · PYSEC-2026-3547 · Published 30/07/2026 · updated 23/10/2026

In breve

CVE-2026-59881 è una vulnerabilità MEDIO (CVSS 6.9) che riguarda aiohttp.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.52%, superiore al 44.4% delle vulnerabilità.
Correzione: aggiornare a 3.14.2 o successiva.

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.14.2`	`3.14.2`

Description

Summary

The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.

Impact

A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.

Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.