Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| crossbario | autobahn-python | before 26.7.1 | 26.7.1 | Patch available | CNA |
| — | autobahn (PyPI) | before 26.7.1 | 26.7.1 | Patch available | GHSA-hxp9-w8x3-p566 |
| — | crossbar (PyPI) | before 26.7.1 | 26.7.1 | Patch available | GHSA-hxp9-w8x3-p566 |
- autobahn-python Vendorcrossbario Affected before 26.7.1 Fixed in 26.7.1 Patch available CNA
- autobahn (PyPI) Vendor— Affected before 26.7.1 Fixed in 26.7.1 Patch available GHSA-hxp9-w8x3-p566
- crossbar (PyPI) Vendor— Affected before 26.7.1 Fixed in 26.7.1 Patch available GHSA-hxp9-w8x3-p566
Remediation
- Fix · CNA autobahn-python (crossbario) Fixed in 26.7.1
- Fix · GHSA-hxp9-w8x3-p566 autobahn (PyPI) Fixed in 26.7.1 Advisory →
- Fix · GHSA-hxp9-w8x3-p566 crossbar (PyPI) Fixed in 26.7.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77528
- 2026-10-03 Alias added: GHSA-hxp9-w8x3-p566
References
Other 5
- https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
- https://github.com/crossbario/autobahn-python/pull/1916
- https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613
- https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1
- https://github.com/crossbario/autobahn-python
More crossbario vulnerabilities
- TI-2026-80681 Memory exhaustion in Autobahn Python permessage-brotli decompression CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-77528 · CVE Program
- CVE-2026-77528 · NVD
- FIRST EPSS
- GHSA-hxp9-w8x3-p566 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences