Medium [CVE-2026-59881] Denial of Service via unnegotiated WebSocket compression
This medium-severity Red Hat Linux advisory covers CVE-2026-59881 affecting Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption.
This issue is fixed in version 3.14.2. A flaw was found in AIOHTTP.
The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sending specially crafted compressed frames.
This can lead to unexpected and excessive consumption of the system's central processing unit (CPU) and memory, potentially resulting in a denial of service (DoS) for legitimate users. Red Hat rates this flaw as Moderate with a CVSS score of 5.3 because exploitation requires an aiohttp WebSocket client to connect to an attacker-controlled server.
In typical Red Hat product deployments, aiohttp serves as an HTTP client library for internal service communication rather than establishing WebSocket connections to untrusted endpoints. The resulting resource consumption is limited to the individual process running the affected client and does not propagate to other services or the host system.
Weakness: CWE-409.
- < 3.14.2
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- For deployments where upgrading is not immediately possible, ensure that aiohttp WebSocket clients only connect to trusted servers. The vulnerability requires the client to have opted out of permessage-deflate compression and the server to send RSV1-flagged frames, so connections using default compression settings are less likely to trigger this issue.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.