Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116579— Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Quick assessment

Affected
crossbario autobahn-python
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Autobahn Python 是一个支持 Twisted 和 asyncio 的 Python WebSocket 与 WAMP 实现。在版本 26.7.1 至 26.10.1 期间， 中的 方法在调用 Brotli 解压器时未设置输出上限，且仅在完整帧解压完成后才检查 。未经认证的 WebSocket 客户端可发送一个体积小但高度压缩的数据帧，在触发拒绝前即可分配数百 MiB 的内存，从而导致启用“每消息 Brotli 压缩”（permessage-brotli）功能的服务器（通过 额外选项显式开启）出现内存耗

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
Source: CVE Program / CVE List V5
Vulnerability Description
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
crossbario autobahn-python >= 26.7.1, < 26.10.1 -

II. Public POCs for CVE-2026-116579

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116579

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116579 (1)

Vendor Advisories for CVE-2026-116579 (1)

Vendor Pages for CVE-2026-116579 (1)

IV. Related Vulnerabilities

Same product: autobahn-python
Same vendor: crossbario
Same weakness: CWE-409