Skip to main content

Improper Input Validation

CVE-2026-59881

Medium
6.9/10

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published