CVE-2026-59881CWE-20

CVE-2026-59881

published July 30, 2026

CVSS
6.9
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-30T23:18Z
References (4)
http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2 · [email protected]https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6 · [email protected]https://github.com/aio-libs/aiohttp/pull/12978 · [email protected]https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7 · [email protected]
EPSS history
Timeline
  • 30 JUL 17:34Z
    AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
    cvelistv5