PYSEC-2026-3547
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-59881
- Alias
- GHSA-mq44-7p77-q5h7
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated. ### Impact A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present. --- Patch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · aiohttp | introduced 0, fixed 3.14.2 |
Références
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-59881 ADVISORY
- https://github.com/aio-libs/aiohttp/pull/12978 WEB
- https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6 WEB
- https://github.com/aio-libs/aiohttp PACKAGE
- http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2 WEB
- https://pypi.org/project/aiohttp PACKAGE
- https://github.com/advisories/GHSA-mq44-7p77-q5h7 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |