CyberRota Analysis
AI-GeneratedThe AIOHTTP framework prior to version 3.14.2 is vulnerable to a denial-of-service attack via its WebSocket client, which improperly handles frames with the RSV1 bit set, leading to potential CPU and memory exhaustion. This vulnerability can be exploited by a malicious server to degrade the performance of affected applications. Developers and organizations utilizing AIOHTTP for WebSocket communications should prioritize upgrading to version 3.14.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.