Fluid Attacks Database

Description

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

Summary

The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.

Impact

A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.

Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	aiohttp	>=0 <3.14.2	3.14.2
debian 12	python-aiohttp	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.10-1 \|\| =3.10.10-2 \|\| =3.10.11-1 \|\| =3.10.3-1 \|\| =3.10.3-2 \|\| =3.10.3-3 \|\| =3.10.4-1 \|\| =3.10.5-1 \|\| =3.10.6-1 \|\| =3.10.8-1 \|\| =3.11.15-1 \|\| =3.11.16-1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| =3.14.1-1 \|\| =3.14.1-2 \|\| =3.14.1-3 \|\| =3.14.1-4 \|\| =3.14.1-5 \|\| =3.14.3-1 \|\| =3.8.4-1 \|\| =3.8.4-1+deb12u1 \|\| =3.8.5-1 \|\| =3.8.6-1 \|\| =3.9.1-1 \|\| =3.9.5-1	-
debian 13	python-aiohttp	=3.11.16-1 \|\| =3.11.16-1+deb13u1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| =3.14.1-1 \|\| =3.14.1-2 \|\| =3.14.1-3 \|\| =3.14.1-4 \|\| =3.14.1-5 \|\| =3.14.3-1	-
rpm rhel10	ansible-core	-	-
rpm rhel9	ansible-core	-	-
debian 14	python-aiohttp	=3.11.16-1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| =3.14.1-1 \|\| =3.14.1-2 \|\| =3.14.1-3 \|\| =3.14.1-4 \|\| =3.14.1-5 \|\| =3.14.3-1	-

Aliases

1. CVE-2026-598812. NVD-2026-598813. OSV-2026-598814. OSV-DEBIAN-2026-598815. GHSA-mq44-7p77-q5h76. GCVE-2026-598817. SECURITY-TRACKER-CVE-2026-59881

References

1. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h72. https://github.com/aio-libs/aiohttp/pull/129783. https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f64. http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.