CVE-2026-59881: Aio-Libs Aiohttp

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

Affected products

• Aio-Libs Aiohttp: before 3.14.2 (fixed in 3.14.2)

Published 2026-07-30. Last modified 2026-07-30.