中危漏洞公告Python2026/10/29 06:10

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

影響: pip:autobahn >= 26.7.1, < 26.10.1 → 26.10.1

permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. Details In 26.7.1 the receive path passes the remaining maxMessagePayloadSize budget to decompress_message_data(..., max_output_len=...). d…

在 GitHub Advisory Database 阅读

在 X 上接收快讯漏洞利用、重大泄露和故障，附应对措施。

关注 @vulnpulse_app

CVE	CVE-2026-116579
来源	GitHub Advisory Database
获取时间	2026/10/29 09:48
数据	Markdown　JSON

2026/10/29 06:10，GitHub Advisory Database 发布了“Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-116579。