{"id":"ghsa-ghsa-pjh6-c8mg-3x7m","seq":2056939,"kind":"advisory","title":"Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)","url":"https://github.com/advisories/GHSA-pjh6-c8mg-3x7m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pjh6-c8mg-3x7m","summary":"影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1\npermessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…","severity":"medium","techs":["python"],"cves":["CVE-2026-116579"],"tags":["GHSA-pjh6-c8mg-3x7m","autobahn"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:10:17.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}