aiohttp CVE-2026-59881

Exploitation requires that the victim application uses aiohttp's WebSocket client component (not the server) and establishes a connection to an attacker-controlled or attacker-compromised WebSocket server. The flaw is triggered when the malicious server sends frames with the RSV1 bit set without having completed permessage-deflate extension negotiation during the WebSocket handshake - a direct RFC 6455 violation that unpatched aiohttp silently accepts. Exploitation is NOT possible against aiohttp acting as a WebSocket server. Exploitation is NOT possible if the client only connects to trusted servers under the operator's control. The CVSS PR:N and UI:N ratings reflect that the attacker-controlled server requires no authentication credential and no end-user gesture once the client application has initiated the outbound WebSocket connection. Limiting factors: the attacker must control the server endpoint being contacted, which requires either owning a service the target application connects to or achieving a network-level man-in-the-middle position.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) correctly reflects network reachability but requires important contextual qualification: this is a client-side vulnerability, meaning the 'attacker' must control or compromise a WebSocket server that the victim aiohttp client connects to. The PR:N and UI:N metrics apply from the malicious server's perspective - no auth is needed and no user gesture is required to trigger decompression once the client connects. Availability impact is rated Low (VA:L) in CVSS 4.0, consistent with the resource exhaustion being bounded rather than immediately fatal. No EPSS score was provided in the input data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. Real-world risk is meaningful only for applications that make outbound WebSocket connections to untrusted or third-party servers; services acting exclusively as WebSocket servers, or clients connecting only to internal trusted endpoints, face negligible exposure. No conflicting signals were identified between the CVSS vector and the description.

An attacker operates a WebSocket server (or compromises a legitimate one) that an aiohttp-based application connects to. During the WebSocket handshake, the server intentionally omits the permessage-deflate extension negotiation, then streams frames with the RSV1 bit set containing large or crafted compressed payloads. Because the unpatched aiohttp client defaults to compress=True, it decompresses these frames unconditionally, consuming disproportionate CPU and memory for each such frame, potentially degrading or crashing the client application process.