Memory exhaustion in Autobahn Python permessage-brotli decompression
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Autobahn Python from 26.7.1 before 26.10.1 decompresses permessage-brotli frames without an output limit, so it inflates a whole frame before checking maxMessagePayloadSize (CWE-409). An unauthenticated remote WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| crossbario | autobahn-python | 26.7.1 to before 26.10.1 | 26.10.1 | Patch available | CNA |
| — | autobahn (PyPI) | 26.7.1 to before 26.10.1 | 26.10.1 | Patch available | GHSA-pjh6-c8mg-3x7m |
- autobahn-python Vendorcrossbario Affected 26.7.1 to before 26.10.1 Fixed in 26.10.1 Patch available CNA
- autobahn (PyPI) Vendor— Affected 26.7.1 to before 26.10.1 Fixed in 26.10.1 Patch available GHSA-pjh6-c8mg-3x7m
Remediation
Upgrade the autobahn PyPI package to 26.10.1. Red Hat lists Red Hat Ansible Automation Platform 2 as affected with no fix available, and Red Hat OpenStack Platform 16.2 as affected with no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA autobahn-python (crossbario) Fixed in 26.10.1
- Fix · GHSA-pjh6-c8mg-3x7m autobahn (PyPI) Fixed in 26.10.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116579
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-27 CVSS score added · Red Hat
- 2026-10-27 CISA SSVC decision points changed
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-10-28 Alias added: GHSA-pjh6-c8mg-3x7m
- 2026-10-28 Fix available: PyPI/[email protected] · GHSA-pjh6-c8mg-3x7m
- 2026-10-28 CVSS score added · GHSA-pjh6-c8mg-3x7m
- 2026-10-28 Weakness changed · GHSA-pjh6-c8mg-3x7m
- 2026-10-28 6 new references · GHSA-pjh6-c8mg-3x7m
References
Other 5
- https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m
- https://github.com/crossbario/autobahn-python/pull/1987
- https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1
- https://github.com/crossbario/autobahn-python/releases/tag/v26_10_1
- https://github.com/crossbario/autobahn-python
More crossbario vulnerabilities
- TI-2026-54051 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-116579 · CVE Program
- CVE-2026-116579 · NVD
- FIRST EPSS
- GHSA-pjh6-c8mg-3x7m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116579 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences