CVE-2026-59881: aio-libs aiohttp resource exhaustion in WebSocket client decompression

CVE-2026-59881 · Severity: medium · CVSS 4 · Published 2026-07-30

A vulnerability exists in the aiohttp library, a popular Python framework for building web services and clients. The WebSocket client component incorrectly processes compressed data even when it has been configured not to do so. This could allow a malicious server to force the client to perform intensive decompression tasks, potentially leading to high CPU and memory usage that could slow down or crash the application.

Technologies: aiohttp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59881 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59881 being exploited in the wild.
How severe is CVE-2026-59881?
Medium severity, with a CVSS score of 4, published 30 July 2026.
Which products and versions are affected?
aiohttp (PyPI) <= 3.14.1, ECOSYSTEM:introduced=0,fixed=3.14.2.
Is there a fix for CVE-2026-59881?
Yes. aiohttp (PyPI): upgrade to 3.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59881 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59881?
Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • aiohttp (PyPI): upgrade to 3.14.2 or later
    pip install "aiohttp>=3.14.2"

Technical details

A vulnerability in aiohttp's WebSocket client implementation involves improper input validation of the RSV1 bit in WebSocket frames. The client fails to verify if the 'permessage-deflate' extension was successfully negotiated before attempting to decompress frames marked with the RSV1 bit. An attacker-controlled WebSocket server can send unsolicited compressed frames to a connected aiohttp client, forcing decompression. This can be leveraged to cause resource exhaustion (CPU/memory), particularly if combined with highly compressed payloads (zip bombs). The issue is fixed in version 3.14.2.

Affected products

  • aio-libs aiohttp <= 3.14.1

Identifiers

  • CVE-2026-59881
  • GHSA-mq44-7p77-q5h7
  • PYSEC-2026-3547

Timeline

  • 2026-07-26: disclosed: Initial disclosure by Dreamsorcerer
  • 2026-07-30: advisory: NVD published CVE-2026-59881
  • 2026-08-03: patched: GitHub Advisory published and version 3.14.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.