CVE-2026-59881: AIOHTTP WebSocket Client Accepts Compressed Frames Without Negotiated Permessage-Deflate
Summary
CVE-2026-59881: AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate. Affects aiohttp versions < 3.14.2. Fixed in 3.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client and server framework for Python, designed to handle asynchronous requests and responses efficiently. It supports WebSocket communication, allowing real-time data exchange between clients and servers. However, a vulnerability has been identified in the WebSocket client component, where it improperly handles compressed frames, potentially leading to unexpected behavior.
Vulnerability Detail
The vulnerability arises from the AIOHTTP client accepting and decompressing WebSocket frames that have the RSV1 bit set, even when the 'permessage-deflate' extension was not negotiated. This could lead to clients decompressing frames when they have explicitly opted out, resulting in increased CPU and memory consumption. While this is unlikely to pose a significant threat on its own, it could be exploited in conjunction with other vulnerabilities, such as a zip bomb, to cause denial of service or resource exhaustion.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.2
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the WebSocket client features that rely on compressed frames until you can update to the patched version. Additionally, ensure that your application explicitly opts out of compression if it is not needed.
Conclusion
In summary, the AIOHTTP WebSocket client vulnerability (CVE-2026-59881) allows for the acceptance of compressed frames without proper negotiation, leading to potential resource exhaustion. It is crucial to update to version 3.14.2 or later to mitigate this risk. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without requiring code access.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include increased CPU and memory consumption, which could lead to performance degradation or denial of service if exploited alongside other vulnerabilities.
While the vulnerability primarily affects resource consumption, it does not directly lead to data loss. However, it could be exploited in a way that indirectly affects application stability.
If you cannot update the package immediately, consider implementing the suggested workaround by avoiding the use of WebSocket features that rely on compressed frames until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
