Threats tagged 'brew-magic-wormhole-cve-2026-116579'

The Autobahn Python permessage-brotli implementation inflates entire frames before enforcing the maxMessagePayloadSize limit, allowing a small compressed frame to cause excessive memory allocation (e.g., 421 bytes inflating to about 545 MiB). This can be exploited by unauthenticated WebSocket clients to cause a denial-of-service via memory exhaustion on servers that enable permessage-brotli compression. The issue bypasses previous fixes intended to limit message payload size. A fix is available in version 0.24.0_5.