https://vulnerability.circl.lu/sightings/feed 2026-08-06T15:34:06.260723+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/bffd6a18-7057-4239-98ad-33b8a19c57ad/export 2026-08-06T15:34:06.282154+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "bffd6a18-7057-4239-98ad-33b8a19c57ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59881", "type": "seen", "source": "https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb", "content": "# CVE-2026-59881: CVE-2026-59881: Unnegotiated WebSocket RSV1 Frame Handling in aiohttp\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59881\n\n## Summary\nCVE-2026-59881 is a protocol compliance and input validation vulnerability in the client-side WebSocket implementation of the aiohttp asynchronous HTTP client/server framework for Python. Prior to version 3.14.2, the framework's parser unexpectedly accepts and attempts to decompress frames containing the RSV1 bit, even when the permessage-deflate extension has not been negotiated during the initial WebSocket handshake. This violation of RFC 6455 allows a malicious or compromised server to bypass client configuration, forcing decompression routines that can lead to high CPU and memory consumption, resulting in a denial-of-service condition.\n\n## TL;DR\nA vulnerability in the aiohttp WebSocket client allows malicious servers to bypass client configuration and force decompression of server-supplied payloads. This occurs because the parser improperly defaults to accepting compressed frames even when the permessage-deflate extension was not negotiated, allowing attackers to trigger a Denial-of-Service (DoS) condition via decompression bombs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00302\n- **Impact**: Denial of Service (DoS) / Resource Exhaustion\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- aiohttp client-side WebSocket reader implementations prior to v3.14.2\n- **aiohttp**: < 3.14.2 (Fixed in: `3.14.2`)\n\n## Mitigation\n\n- Upgrade to aiohttp version 3.14.2 or higher to enforce strict compliance with WebSocket frame specifications.\n- Restrict outgoing WebSocket client connections to verified and authenticated hosts.\n- Deploy container-level CPU and memory limits to prevent processes from crashing the entire host system during resource exhaustion events.\n- Avoid using unencrypted WebSocket connections (ws://) to prevent frame injection attacks by intermediaries.\n\n**Remediation Steps:**\n1. Identify all projects and dependencies running aiohttp versions prior to 3.14.2.\n2. Update requirements.txt, setup.py, or Pipfile configurations to require aiohttp >= 3.14.2.\n3. Run your application's test suite to ensure compatibility with the updated version.\n4. Rebuild your deployment containers and push the patched version to production environments.\n\n## References\n\n- [NVD Entry for CVE-2026-59881](https://nvd.nist.gov/vuln/detail/CVE-2026-59881)\n- [GitHub Security Advisory GHSA-mq44-7p77-q5h7](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7)\n- [aiohttp Release Tag v3.14.2](http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59881) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T04:31:09.945635Z"} 2026-08-04T04:31:09.945635+00:00