CVE-2026-59881

CVE-2026-59881 is a resource exhaustion vulnerability in AIOHTTP's WebSocket client where RSV1 bit handling fails to gate decompression on proper extension negotiation. When a client connects to a malicious server that sends compressed frames without agreeing on the permessage-deflate extension, the library will attempt decompression on arbitrary data, causing unbounded memory allocation and CPU consumption. The practical impact depends heavily on your usage pattern. If your application initiates WebSocket connections to third-party or untrusted endpoints—APIs, external services, websocket-based feeds—this vulnerability is exploitable trivially by having your code connect to a malicious server. This is not a case where you need to trick a user into clicking something; automated clients, monitoring agents, CI/CD pipeline steps, and aggregation workers that connect to configurable URLs are all directly exposed. The attack surface includes any scenario where an attacker can control or influence the destination URL. Check your dependency tree: this affects AIOHTTP versions prior to 3.14.2. If you're using the library for outbound WebSocket client functionality, prioritize upgrading. But note that the upgrade alone doesn't remove vulnerable code from your ecosystem—check Docker layers, cached build artifacts, and lock files that may still reference older versions. The deployment reality is that pip-installed packages don't self-update, and client library DoS vulnerabilities often get triaged lower than they deserve because developers reason 'my code only connects to trusted servers'—until someone adds an exception. The deeper pattern here is that WebSocket client libraries have repeatedly made permissive parsing choices for interoperability, and this class of vulnerability (RSV1 ambiguity without extension negotiation) has a documented history dating back to WSpermis in 2015. Library consumers have no practical visibility into these protocol-level shortcuts. The systemic risk is that you inherit the library's security decisions without ability to audit them. When using AIOHTTP for client-side WebSocket connections, consider explicitly validating server behavior or running in constrained memory environments that will terminate rather than OOM on malicious input.

Reviewed through automated stages and approved by a human before publication.