{"id":"CVE-2026-59881","aliases":["GHSA-mq44-7p77-q5h7","PYSEC-2026-3547"],"url":"https://o3.security/vulnerability/CVE-2026-59881","summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","details":"### Summary\n\nThe client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.\n\n### Impact\n\nA client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","published":"2026-07-30T17:34:32.415Z","modified":"2026-10-28T02:30:44.983561591Z","cvss":null,"epss":{"score":0.00302,"percentile":0.22922,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"aiohttp","fixedVersion":"3.14.2"}],"fix":{"url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","label":"aio-libs/aiohttp@47fb6ae"},"references":[{"type":"WEB","url":"http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59881.json"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:44.983561591Z"}}