CVE-2026-116579

MediumCVSS 5.9

Published: 26/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

37th percentile - higher than 37% of all known CVEs

Summary

In Autobahn Python from 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame is inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection.

Risk Assessment

An attacker could remotely exhaust server memory and cause denial of service. This affects servers with the opt-in permessage-brotli feature enabled.

Recommendation

Update Autobahn Python to version 26.10.1 or later. Consider disabling permessage-brotli until patched.

Other vulnerabilities in Autobahn Python

CVE-2026-77528Medium
Autobahn Python prior to 26.7.1 contains a vulnerability in WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize, where the limit is enforced on the compressed frame length before inflation but not rechecked after decompression. A remote unauthenticated client can send a valid compressed frame below the wire-size limit that expands beyond the application message limit, causing oversized data to be allocated and processed, potentially leading to resource exhaustion.

Original NVD description (English source)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS