CVE-2026-77528

MediumCVSS 5.3

Published: 18/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

42th percentile - higher than 42% of all known CVEs

Summary

Autobahn Python prior to 26.7.1 contains a vulnerability in WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize, where the limit is enforced on the compressed frame length before inflation but not rechecked after decompression. A remote unauthenticated client can send a valid compressed frame below the wire-size limit that expands beyond the application message limit, causing oversized data to be allocated and processed, potentially leading to resource exhaustion.

Risk Assessment

The risk includes potential resource exhaustion (e.g., memory) via specially crafted frames, potentially leading to service unavailability.

Recommendation

Upgrade Autobahn Python to version 26.7.1 or later and monitor resource usage on WebSocket endpoints.

Other vulnerabilities in Autobahn Python

CVE-2026-116579Medium
In Autobahn Python from 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame is inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection.

Original NVD description (English source)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS