CVE-2026-77528: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in crossbario autobahn-python
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
AI Analysis
Technical Summary
Autobahn Python, a WebSocket and WAMP implementation, prior to version 26.7.1, improperly enforces message size limits for compressed WebSocket frames. While it checks the compressed frame length against maxMessagePayloadSize, it does not verify the decompressed message size before delivering it to application callbacks. A remote unauthenticated attacker can send a compressed frame within the wire-size limit that decompresses to a message exceeding the application limit, causing resource exhaustion through oversized data allocation and processing. This vulnerability is tracked as CVE-2026-77528 and is fixed in version 26.7.1.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause resource exhaustion on the affected system by sending specially crafted compressed WebSocket frames that decompress to oversized messages. There is no impact on confidentiality or integrity, but availability may be affected due to resource exhaustion.
Mitigation Recommendations
Upgrade autobahn-python to version 26.7.1 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.
CVE-2026-77528: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in crossbario autobahn-python
Description
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
CVSS v3.1
Score 5.3medium
Affected software
crossbario
autobahn-python
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Autobahn Python, a WebSocket and WAMP implementation, prior to version 26.7.1, improperly enforces message size limits for compressed WebSocket frames. While it checks the compressed frame length against maxMessagePayloadSize, it does not verify the decompressed message size before delivering it to application callbacks. A remote unauthenticated attacker can send a compressed frame within the wire-size limit that decompresses to a message exceeding the application limit, causing resource exhaustion through oversized data allocation and processing. This vulnerability is tracked as CVE-2026-77528 and is fixed in version 26.7.1.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause resource exhaustion on the affected system by sending specially crafted compressed WebSocket frames that decompress to oversized messages. There is no impact on confidentiality or integrity, but availability may be affected due to resource exhaustion.
Mitigation Recommendations
Upgrade autobahn-python to version 26.7.1 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T20:23:02.508Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad953b55bf5e2cf577b89e
Added to database: 09/18/2026, 19:47:07 UTC
Last enriched: 09/18/2026, 20:02:56 UTC
Last updated: 09/18/2026, 22:12:51 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.