Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1
permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…
| CVE | CVE-2026-116579 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 06:10, GitHub Advisory Database에서 "Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-116579.