UBUNTU-CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

GHSA-MQ44-7P77-Q5H7 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

Summary The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated. Impact A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket client. An attacker can cause unexpected decompression of WebSocket frames by sending frames with the RSV1 bit set without proper negotiation, potentially leading to...

PT-2026-66548

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.2 Description The WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension a mechanism used to compress WebSocket messages to reduce bandwidth was not...