Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | <= 3.14.1 | 3.14.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the WebSocketReader class, which is responsible for parsing WebSocket frames. Its constructor, __init__, had a default parameter compress=True, which meant that the reader would always try to decompress frames with the RSV1 bit set, regardless of whether the permessage-deflate compression extension was negotiated. The ClientSession._ws_connect method, which sets up the client-side WebSocket connection, failed to override this default. As a result, a malicious server could send compressed frames to a client that had not agreed to compression, causing unexpected CPU and memory usage. The patch rectifies this by removing the default value in WebSocketReader.__init__ and explicitly passing the compression setting from ClientSession._ws_connect, ensuring that decompression is only performed when negotiated.
WebSocketReader.__init__aiohttp/_websocket/reader_py.py
ClientSession._ws_connectaiohttp/client.py