## Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-116579
- 公開日時: 2026-10-28T21:10:17.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pjh6-c8mg-3x7m)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pjh6-c8mg-3x7m

影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1
permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…