Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
In EPEL10, this can’t be fixed by updating because several intervening “minor” releases contained documented breaking changes, including 3.14.0, https://github.com/aio-libs/aiohttp/releases#release-v3.14.0. Looking at https://www.cve.org/CVERecord?id=CVE-2026-59881, https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7, and the fix https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6, it may be possible to backport the fix to at least EPEL10, which hasn’t diverged as severely as EPEL8 and EPEL9 have. I’ve been updating this package lately via my python-packagers-sig group membership, but I wish someone else would take an interest in it. I will probably work on this CVE after a while, but it isn’t at the top of my list.