CVE-2026-77528 Details
Description
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
A vulnerability exists in Autobahn Python versions prior to 26.7.1, specifically within the WebSocket implementation that supports permessage-deflate compression. The issue arises because the library enforces the 'maxMessagePayloadSize' limit against the compressed frame length before inflation, but fails to recheck the size of the decompressed message before delivering it to application callbacks. This oversight allows a remote, unauthenticated client to send a compressed frame that, while under the wire-size limit, expands beyond the application message limit when inflated. As a result, oversized data can be processed by application callbacks, potentially leading to resource exhaustion. The vulnerability does not impact confidentiality or integrity.
Users can upgrade to Autobahn Python version 26.7.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613 | [email protected] | Source CodeVendor |
| https://github.com/crossbario/autobahn-python/pull/1916 | [email protected] | Source CodeVendor |
| https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1 | [email protected] | Release NotesVendor |
| https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Autobahn Python | < 26.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |