Technical impact
The flaw resides in AIOHTTP's WebSocket client, which incorrectly processes frames marked with an RSV1 bit that indicates compression, even when the permessage-deflate extension was not negotiated. This allows a server to send compressed frames that the client will unexpectedly decompress, consuming significant CPU cycles and memory. The resulting resource exhaustion can lead to service slowdown or crash, depriving legitimate users of the affected application.
Affected Systems
The vulnerability affects the aio-libs AIOHTTP library for Python. Any deployment using aiohttp prior to version 3.14.2 is potentially exposed, including client applications that rely on WebSocket communication. All earlier releases that do not include the patch are impacted.
Risk and Exploitability
The CVSS score of 6.9 categorizes the weakness as medium severity, while the EPSS score of less than 1% indicates a very low to negligible probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. The principal attack path requires a malicious WebSocket server that sends compressed frames with the RSV1 bit set. An attacker can trigger the resource exhaustion by sending numerous such frames, affecting availability of the client application. Given the remote nature of the communication, the threat can materialize without local access.
Debian DLA
Github GHSA