Most recent entries from all

CVE-2026-59881 — AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

2026-09-28T16:18:55.989255+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

GHSA-mq44-7p77-q5h7 — AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

2026-09-28T16:18:55.989359+00:00

Affected: PyPI: aiohttp

### Summary

The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.

### Impact

A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.

---

Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6

PYSEC-2026-3547 — AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

2026-09-28T16:18:55.989410+00:00

Affected: PyPI: aiohttp

### Summary

The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.

### Impact

---

Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6