CVE-2026-116579
An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress…
Does this matter?
Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.
Description
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-409, CWE-770
- Source
- security-advisories@github.com
References
- https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1
- https://github.com/crossbario/autobahn-python/pull/1987
- https://github.com/crossbario/autobahn-python/releases/tag/v26_10_1
- https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.