PyPI/aiohttp CVE-2026-59881: medium 6.9, EPSS 0.52%

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

Action: Upgrade aiohttp to 3.14.2 or later.

pip install aiohttp==3.14.2

Affected

Fixed versions

Sources

• osv: GHSA-mq44-7p77-q5h7
• nvd: CVE-2026-59881
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7
• https://github.com/aio-libs/aiohttp/pull/12978
• https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
• https://github.com/aio-libs/aiohttp
• http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2

CVE-2026-59881 · published 2026-08-03T20:40:55Z · modified 2026-09-10T03:51:14.489650589Z · JSON