CVE-2026-77528: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Autobahn Pythonto a version that resolves this vulnerability.Fixed in 26.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WebSocket endpoints using Autobahn Python before 26.7.1 are exposed if they accept permessage-deflate and rely on maxMessagePayloadSize to constrain message size. Endpoints that do not accept permessage-deflate are not identified as affected by the advisory.
What does an attacker need to exploit it?
A remote unauthenticated client only needs network access to a vulnerable WebSocket endpoint. They can submit a valid compressed frame that is below the configured wire-size limit but expands beyond the intended application message limit after inflation.
What is the practical impact?
The oversized decompressed message can be allocated, joined, validated, and delivered to application callbacks, creating resource-exhaustion pressure. The advisory does not establish confidentiality or integrity impact.
What should be done if patching cannot happen immediately?
Limit or disable acceptance of permessage-deflate on affected WebSocket endpoints where possible, particularly where maxMessagePayloadSize is relied on as a message-size control. Upgrade to Autobahn Python 26.7.1 to apply the fix.