CVE-2026-59881
Vulnerability Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-20
Source
NVD
Vendor
aio-libs
Product
aiohttp
Discussion (0)
Add Comment
No comments yet. Be the first!