CVE-2026-59881
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
CVE-2026-59881- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-51257
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
EUVD-2026-51257- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mq44-7p77-q5h7
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.
Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
- Record
GHSA-mq44-7p77-q5h7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
CVE-2026-59881- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
CVE-2026-59881- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-59881
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
DEBIAN-CVE-2026-59881- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 16 moreShow less
OSVGHSA-mq44-7p77-q5h7
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.
Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
- Record
GHSA-mq44-7p77-q5h7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVOESA-2026-3277
python-aiohttp security update
Async http client/server framework (asyncio).
Security Fix(es):
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.(CVE-2026-59881)
- Record
OESA-2026-3277- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVOESA-2026-3278
python-aiohttp security update
Async http client/server framework (asyncio).
Security Fix(es):
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.(CVE-2026-59881)
- Record
OESA-2026-3278- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVOESA-2026-3279
python-aiohttp security update
Async http client/server framework (asyncio).
Security Fix(es):
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.(CVE-2026-59881)
- Record
OESA-2026-3279- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVPYSEC-2026-3547
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.
Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
- Record
PYSEC-2026-3547- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59881
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
UBUNTU-CVE-2026-59881- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVAZL-94397 No score
CVE-2026-59881 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
- Record
AZL-94397- Updated
- 2026-11-05
OSVCLSA-2026-1786515832 No score
TuxCare security update for aiohttp (3 CVEs)
TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.6.post9+tuxcare.
- Record
CLSA-2026-1786515832- Updated
- 2026-11-02
OSVCLSA-2026-1787723258 No score
TuxCare security update for aiohttp (3 CVEs)
TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.5.post10+tuxcare.
- Record
CLSA-2026-1787723258- Updated
- 2026-11-02
OSVCLSA-2026-1787905713 No score
TuxCare security update for aiohttp (2 CVEs)
TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post7+tuxcare.
- Record
CLSA-2026-1787905713- Updated
- 2026-11-02
OSVCLSA-2026-1788442611 No score
TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post12+tuxcare.
- Record
CLSA-2026-1788442611- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11467-1 No score
python313-aiohttp-3.14.3-1.1 on GA media
These are all security issues fixed in the python313-aiohttp-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11467-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21687-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
- Record
openSUSE-SU-2026:21687-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23571-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
- Record
SUSE-SU-2026:23571-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4031-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
- Record
SUSE-SU-2026:4031-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4113-1 No score
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- Record
SUSE-SU-2026:4113-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aiohttpPyPI |
through 3.14.1 | 3.14.2 |
python-aiohttpAzure Linux:3 |
through 3.6.2-3 | None known |
aiohttpTuxCare:PyPI From an advisory covering 3 CVEs |
3.8.6 up to 3.8.6.post9+tuxcare, plus listed versions 3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare |
3.8.6.post9+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 3 CVEs |
3.8.5 up to 3.8.5.post10+tuxcare, plus listed versions 3.8.5.post1+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare Show 4 moreShow less3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare |
3.8.5.post10+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 2 CVEs |
3.8.4 up to 3.8.4.post7+tuxcare, plus listed versions 3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare |
3.8.4.post7+tuxcare |
aiohttpTuxCare:PyPI |
3.8.1 up to 3.8.1.post12+tuxcare, plus listed versions 3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare Show 6 moreShow less3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare |
3.8.1.post12+tuxcare |
python-aiohttpDebian:12 |
before 3.8.4-1+deb12u2, plus listed versions 3.8.4-13.8.4-1+deb12u1 |
3.8.4-1+deb12u2 |
python-aiohttpDebian:13 |
All versions, plus listed versions 3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1 Show 11 moreShow less3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1 |
None known |
python-aiohttpDebian:14 |
before 3.14.3-1, plus listed versions 3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-1 Show 9 moreShow less3.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-5 |
3.14.3-1 |
aiohttpPyPI |
before 3.14.2, plus listed versions 0.10.10.00.10.10.10.20.11.0 Show 45 moreShow less0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2 |
3.14.2 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-aiohttpopenEuler:24.03-LTS-SP3 |
before 3.14.3-1.oe2403sp3 | 3.14.3-1.oe2403sp3 |
python-aiohttpopenEuler:24.03-LTS-SP4 |
before 3.14.3-1.oe2403sp4 | 3.14.3-1.oe2403sp4 |
python-aiohttpopenEuler:24.03-LTS-SP1 |
before 3.14.3-1.oe2403sp1 | 3.14.3-1.oe2403sp1 |
python-aiohttpSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 3.11.16-160000.7.1 | 3.11.16-160000.7.1 |
python-aiohttpSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 3.11.16-160000.7.1 | 3.11.16-160000.7.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 3 CVEs |
before 3.9.3-150400.10.46.1 | 3.9.3-150400.10.46.1 |
python-aiohttpSUSE:Linux Enterprise Module for Python 3 15 SP7 From an advisory covering 3 CVEs |
before 3.9.3-150400.10.46.1 | 3.9.3-150400.10.46.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 2 CVEs |
before 3.6.0-150100.3.41.1 | 3.6.0-150100.3.41.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 2 CVEs |
before 3.6.0-150100.3.41.1 | 3.6.0-150100.3.41.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 2 CVEs |
before 3.6.0-150100.3.41.1 | 3.6.0-150100.3.41.1 |
python-aiohttpSUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 2 CVEs |
before 3.6.0-150100.3.41.1 | 3.6.0-150100.3.41.1 |
python-aiohttpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1 |
None known |
python-aiohttpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1 Show 4 moreShow less3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7 |
None known |
python-aiohttpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1 Show 7 moreShow less3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6 |
None known |
python-aiohttpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1 Show 4 moreShow less3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3 |
None known |
python-aiohttpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3 |
None known |
python-aiohttpUbuntu:26.10 |
All versions, plus listed versions 3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1 |
None known |
python-aiohttpUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1 |
None known |
python-aiohttpopenSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 3.14.3-1.1 | 3.14.3-1.1 |
python-aiohttpopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 3.11.16-160000.7.1 | 3.11.16-160000.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59881 is a medium vulnerability (CVSS 6.9) in Aio-libs Aiohttp, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in aiohttp 3.14.2.
References
github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7
nvd.nist.gov/vuln/detail/CVE-2026-59881
Show 25 moreShow less
security-tracker.debian.org/tracker/CVE-2026-59881
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3277
pypi.org/project/aiohttp
suse.com/support/update/announcement/2026/suse-su-202623571-1
bugzilla.suse.com/1273125
ubuntu.com/security/CVE-2026-59881
cve.org/CVERecord?id=CVE-2026-59881
Left out here: 258 versions. The JSON record has them.