CVE-2026-59881Medium· 5.3▾ SunlitA flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sendin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
— → 5.3
0.3% → 0.5%
Last analysed / modified upstream
A flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sending specially crafted compressed frames. This can lead to unexpected and excessive consumption of the system's central processing unit (CPU) and memory, potentially resulting in a denial of service (DoS) for legitimate users.
aiohttp: AIOHTTP: Denial of Service via unnegotiated WebSocket compression — rated Moderate by Red Hat. Released 2026-07-30, updated 2026-10-15.
Affected:
Fixed:
No fix planned:
Not affected:
For more information visit https://access.redhat.com/errata/RHSA-2026:73859 https://access.redhat.com/errata/RHSA-2026:73859 For more information visit https://access.redhat.com/errata/RHSA-2026:73929 https://access.redhat.com/errata/RHSA-2026:73929 For more information visit https://access.redhat.com/errata/RHSA-2026:73930 https://access.redhat.com/errata/RHSA-2026:73930
Workarounds / mitigations:
Affected packages:
aiohttp < 3.14.2Patched in:
aiohttp 3.14.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58203Medium· 5.3pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max…
CVE-2026-112892High· 7.5pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-22815Medium· 5.3aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling (CVE-2026-22815)
CVE-2026-42311High· 7.8Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing (CVE-2026-42311)
CVE-2026-49855High· 7.5tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)