DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59881: CVE-2026-59881: Unnegotiated WebSocket RSV1 Frame Handling in aiohttp

#security #cve #cybersecurity

CVE-2026-59881: Unnegotiated WebSocket RSV1 Frame Handling in aiohttp

Vulnerability ID: CVE-2026-59881
CVSS Score: 6.9
Published: 2026-08-03

CVE-2026-59881 is a protocol compliance and input validation vulnerability in the client-side WebSocket implementation of the aiohttp asynchronous HTTP client/server framework for Python. Prior to version 3.14.2, the framework's parser unexpectedly accepts and attempts to decompress frames containing the RSV1 bit, even when the permessage-deflate extension has not been negotiated during the initial WebSocket handshake. This violation of RFC 6455 allows a malicious or compromised server to bypass client configuration, forcing decompression routines that can lead to high CPU and memory consumption, resulting in a denial-of-service condition.

TL;DR

A vulnerability in the aiohttp WebSocket client allows malicious servers to bypass client configuration and force decompression of server-supplied payloads. This occurs because the parser improperly defaults to accepting compressed frames even when the permessage-deflate extension was not negotiated, allowing attackers to trigger a Denial-of-Service (DoS) condition via decompression bombs.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9 (Medium)
  • EPSS Score: 0.00302
  • Impact: Denial of Service (DoS) / Resource Exhaustion
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • aiohttp client-side WebSocket reader implementations prior to v3.14.2
  • aiohttp: < 3.14.2 (Fixed in: 3.14.2)

Code Analysis

Commit: 47fb6ae

Fix client handling of unnegotiated RSV1 compression frames

Exploit Details

Mitigation Strategies

  • Upgrade to aiohttp version 3.14.2 or higher to enforce strict compliance with WebSocket frame specifications.
  • Restrict outgoing WebSocket client connections to verified and authenticated hosts.
  • Deploy container-level CPU and memory limits to prevent processes from crashing the entire host system during resource exhaustion events.
  • Avoid using unencrypted WebSocket connections (ws://) to prevent frame injection attacks by intermediaries.

Remediation Steps:

  1. Identify all projects and dependencies running aiohttp versions prior to 3.14.2.
  2. Update requirements.txt, setup.py, or Pipfile configurations to require aiohttp >= 3.14.2.
  3. Run your application's test suite to ensure compatibility with the updated version.
  4. Rebuild your deployment containers and push the patched version to production environments.

References

Read the full report for CVE-2026-59881 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)