CVE-2026-77528

MEDIUM 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

CWE	CWE-409 CWE-770
Vendor	crossbario
Product	autobahn-python
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for crossbario autobahn-python

Be the first to know when new medium vulnerabilities affecting crossbario autobahn-python are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

crossbario / autobahn-python

< 26.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566 github.com: https://github.com/crossbario/autobahn-python/pull/1916 github.com: https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613 github.com: https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1