Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1
permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…
Read on GitHub Advisory Database
| CVE | CVE-2026-116579 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/29/2026, 09:48 AM |
| Data | Markdown JSON |
On 10/29/2026, 06:10 AM, GitHub Advisory Database published "Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-116579.