警告脆弱性アドバイザリPython2026/10/29 06:10

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1

permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…

GitHub Advisory Databaseで読む

X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。

フォロー @vulnpulse_app

CVE	CVE-2026-116579
情報源	GitHub Advisory Database
取得日時	2026/10/29 09:48
データ	Markdown　JSON

2026/10/29 06:10、GitHub Advisory Databaseが「Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-116579。