cyfenced.com →

[ CVE-2026-77528 · Published 18 Sep 2026 ]

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

CVSS 5.3 EPSS <1%Fix available

[ Description ]Official description

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

[ Fixes ]Fixes and patches

  • autobahn 26.7.1Fixed version · GitHub Advisories · pip package autobahn: upgrade to 26.7.1 or later (affected < 26.7.1)
  • crossbar 26.7.1Fixed version · GitHub Advisories · pip package crossbar: upgrade to 26.7.1 or later (affected < 26.7.1)

[ Packages ]Affected open-source packages

[ References ]References