Executive brief
A vulnerability exists in the aiohttp library, a popular Python framework for building web services and clients. The WebSocket client component incorrectly processes compressed data even when it has been configured not to do so. This could allow a malicious server to force the client to perform intensive decompression tasks, potentially leading to high CPU and memory usage that could slow down or crash the application.
Technical details
A vulnerability in aiohttp's WebSocket client implementation involves improper input validation of the RSV1 bit in WebSocket frames. The client fails to verify if the 'permessage-deflate' extension was successfully negotiated before attempting to decompress frames marked with the RSV1 bit. An attacker-controlled WebSocket server can send unsolicited compressed frames to a connected aiohttp client, forcing decompression. This can be leveraged to cause resource exhaustion (CPU/memory), particularly if combined with highly compressed payloads (zip bombs). The issue is fixed in version 3.14.2.
Affected products
- aio-libs aiohttp <= 3.14.1
Timeline
- 2026-07-26: disclosed: Initial disclosure by Dreamsorcerer
- 2026-07-30: advisory: NVD published CVE-2026-59881
- 2026-08-03: patched: GitHub Advisory published and version 3.14.2 released