CVE-2026-59881

Deferred Deferred - Pending Action

Memory Exhaustion in AIOHTTP WebSocket Client

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-59881

EUVD

EUVD-2026-51257

Affected Vendors & Products

Vendor	Product	Version / Range
aiohttp	aiohttp	3.14.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

AIOHTTP is a Python framework for HTTP client/server operations. The vulnerability involves the WebSocket client accepting and decompressing frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated. This allows a malicious server to cause unexpected CPU and memory consumption.

Detection Guidance

Detecting this vulnerability requires checking the version of aiohttp in use. Run: pip show aiohttp. If the version is below 3.14.2, the system is vulnerable. No specific network commands are provided for detection.

Impact Analysis

This vulnerability can lead to increased CPU and memory usage on systems using affected versions of AIOHTTP, potentially causing performance degradation or denial of service if exploited by a malicious server.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks through excessive CPU and memory consumption. Uncontrolled resource usage may lead to service disruptions, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade aiohttp to version 3.14.2 or later. Use pip install --upgrade aiohttp. Ensure all dependencies are updated to avoid compatibility issues.

Hi! I’m here to help you understand CVE-2026-59881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70