CVE-2026-77528

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

5.3 MediumFix available

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.52%Up 0.1 points since Sep 19, 2026

What each source reports

CVE List Score used 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Record: CVE-2026-77528
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-409, CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-83415 5.3

Record: EUVD-2026-83415
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hxp9-w8x3-p566 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary

Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 bytes and reach onMessage even when the application configured a 128-byte message limit, defeating the resource boundary the option is meant to provide.

Details

The permessage-deflate path installs a PerMessageDeflate instance when the server accepts a client offer in src/autobahn/websocket/protocol.py:3371. The common PerMessageDeflateOfferAccept(offer) path leaves max_message_size at its default None in src/autobahn/websocket/compress_deflate.py:295, and that value is copied into the compressor object in src/autobahn/websocket/compress_deflate.py:723. When a data frame arrives with RSV1 set, Autobahn marks the message compressed in src/autobahn/websocket/protocol.py:1812, calls onMessageFrameBegin with the compressed frame length, and increments message_data_total_length by that pre-inflate length in src/autobahn/websocket/protocol.py:634; the configured message cap is enforced against the same compressed accounting at src/autobahn/websocket/protocol.py:636. Only after those checks does Autobahn inflate the payload in src/autobahn/websocket/protocol.py:1861; because max_message_size is None, src/autobahn/websocket/compress_deflate.py:812 calls zlib without an output cap. The inflated bytes are then passed to onMessageFrameData in src/autobahn/websocket/protocol.py:1882, appended for WebSocket version 13 without adding their inflated length to the message counter at src/autobahn/websocket/protocol.py:667, joined in src/autobahn/websocket/protocol.py:690, and delivered through _onMessage in src/autobahn/websocket/protocol.py:693. This is the same structural boundary mistake as CVE-2016-10544: a compressed-size check is treated as if it bounded the decompressed application message.

Reproduction

import sys
import types
import zlib


if len(sys.argv) != 2:
    raise SystemExit("usage: autobahn_deflate_limit_poc.py <autobahn-python-source-dir>")

SRC = sys.argv[1]


class _Log:
    def debug(self, *args, **kwargs):
        pass

    def warn(self, *args, **kwargs):
        pass

    def error(self, *args, **kwargs):
        pass


class _Timer:
    def call_later(self, *args, **kwargs):
        return self

    def cancel(self):
        pass


txaio = types.ModuleType("txaio")
txaio.make_logger = lambda: _Log()
txaio.create_future = lambda result=None: result
txaio.resolve = lambda future, value=None: None
txaio.reject = lambda future, error=None: None
txaio.add_callbacks = (
    lambda future, callback=None, errback=None: callback(future) if callback else None
)
txaio.as_future = lambda fn, *args, **kwargs: fn(*args, **kwargs)
txaio.failure_format_traceback = lambda err: str(err)
txaio.call_later = lambda *args, **kwargs: _Timer()
txaio.make_batched_timer = lambda *args, **kwargs: _Timer()
txaio.time_ns = lambda: 0
txaio.use_asyncio = lambda: None
txaio.use_twisted = lambda: None
sys.modules["txaio"] = txaio

hyperlink = types.ModuleType("hyperlink")


class _URL:
    @classmethod
    def from_text(cls, text):
        return cls(text)

    def __init__(self, text):
        self._text = text

    def to_uri(self):
        return self

    def normalize(self):
        return self

    def to_text(self):
        return self._text


hyperlink.URL = _URL
sys.modules["hyperlink"] = hyperlink

wamp_types = types.ModuleType("autobahn.wamp.types")


class TransportDetails:
    pass


wamp_types.TransportDetails = TransportDetails
sys.modules["autobahn.wamp.types"] = wamp_types

sys.path.insert(0, SRC + "/src")

from autobahn.websocket.compress_deflate import PerMessageDeflate
from autobahn.websocket.protocol import WebSocketProtocol


class _Factory:
    isServer = True
   …

Record: GHSA-hxp9-w8x3-p566
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-409, CWE-770
Updated: 2026-11-02

NVD 5.3

Record: CVE-2026-77528
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-409, CWE-770
Updated: 2026-11-02

OSV 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Record: CVE-2026-77528
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-409, CWE-770
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-77528 5.3

Record: DEBIAN-CVE-2026-77528
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-hxp9-w8x3-p566 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary

Details

Reproduction

import sys
import types
import zlib


if len(sys.argv) != 2:
    raise SystemExit("usage: autobahn_deflate_limit_poc.py <autobahn-python-source-dir>")

SRC = sys.argv[1]


class _Log:
    def debug(self, *args, **kwargs):
        pass

    def warn(self, *args, **kwargs):
        pass

    def error(self, *args, **kwargs):
        pass


class _Timer:
    def call_later(self, *args, **kwargs):
        return self

    def cancel(self):
        pass


txaio = types.ModuleType("txaio")
txaio.make_logger = lambda: _Log()
txaio.create_future = lambda result=None: result
txaio.resolve = lambda future, value=None: None
txaio.reject = lambda future, error=None: None
txaio.add_callbacks = (
    lambda future, callback=None, errback=None: callback(future) if callback else None
)
txaio.as_future = lambda fn, *args, **kwargs: fn(*args, **kwargs)
txaio.failure_format_traceback = lambda err: str(err)
txaio.call_later = lambda *args, **kwargs: _Timer()
txaio.make_batched_timer = lambda *args, **kwargs: _Timer()
txaio.time_ns = lambda: 0
txaio.use_asyncio = lambda: None
txaio.use_twisted = lambda: None
sys.modules["txaio"] = txaio

hyperlink = types.ModuleType("hyperlink")


class _URL:
    @classmethod
    def from_text(cls, text):
        return cls(text)

    def __init__(self, text):
        self._text = text

    def to_uri(self):
        return self

    def normalize(self):
        return self

    def to_text(self):
        return self._text


hyperlink.URL = _URL
sys.modules["hyperlink"] = hyperlink

wamp_types = types.ModuleType("autobahn.wamp.types")


class TransportDetails:
    pass


wamp_types.TransportDetails = TransportDetails
sys.modules["autobahn.wamp.types"] = wamp_types

sys.path.insert(0, SRC + "/src")

from autobahn.websocket.compress_deflate import PerMessageDeflate
from autobahn.websocket.protocol import WebSocketProtocol


class _Factory:
    isServer = True
   …

Record: GHSA-hxp9-w8x3-p566
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-409, CWE-770
Updated: 2026-11-02

OSVPYSEC-2026-4027 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary

Details

Reproduction

import sys
import types
import zlib


if len(sys.argv) != 2:
    raise SystemExit("usage: autobahn_deflate_limit_poc.py <autobahn-python-source-dir>")

SRC = sys.argv[1]


class _Log:
    def debug(self, *args, **kwargs):
        pass

    def warn(self, *args, **kwargs):
        pass

    def error(self, *args, **kwargs):
        pass


class _Timer:
    def call_later(self, *args, **kwargs):
        return self

    def cancel(self):
        pass


txaio = types.ModuleType("txaio")
txaio.make_logger = lambda: _Log()
txaio.create_future = lambda result=None: result
txaio.resolve = lambda future, value=None: None
txaio.reject = lambda future, error=None: None
txaio.add_callbacks = (
    lambda future, callback=None, errback=None: callback(future) if callback else None
)
txaio.as_future = lambda fn, *args, **kwargs: fn(*args, **kwargs)
txaio.failure_format_traceback = lambda err: str(err)
txaio.call_later = lambda *args, **kwargs: _Timer()
txaio.make_batched_timer = lambda *args, **kwargs: _Timer()
txaio.time_ns = lambda: 0
txaio.use_asyncio = lambda: None
txaio.use_twisted = lambda: None
sys.modules["txaio"] = txaio

hyperlink = types.ModuleType("hyperlink")


class _URL:
    @classmethod
    def from_text(cls, text):
        return cls(text)

    def __init__(self, text):
        self._text = text

    def to_uri(self):
        return self

    def normalize(self):
        return self

    def to_text(self):
        return self._text


hyperlink.URL = _URL
sys.modules["hyperlink"] = hyperlink

wamp_types = types.ModuleType("autobahn.wamp.types")


class TransportDetails:
    pass


wamp_types.TransportDetails = TransportDetails
sys.modules["autobahn.wamp.types"] = wamp_types

sys.path.insert(0, SRC + "/src")

from autobahn.websocket.compress_deflate import PerMessageDeflate
from autobahn.websocket.protocol import WebSocketProtocol


class _Factory:
    isServer = True
   …

Record: PYSEC-2026-4027
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVPYSEC-2026-4031 5.3

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary

Details

Reproduction

import sys
import types
import zlib


if len(sys.argv) != 2:
    raise SystemExit("usage: autobahn_deflate_limit_poc.py <autobahn-python-source-dir>")

SRC = sys.argv[1]


class _Log:
    def debug(self, *args, **kwargs):
        pass

    def warn(self, *args, **kwargs):
        pass

    def error(self, *args, **kwargs):
        pass


class _Timer:
    def call_later(self, *args, **kwargs):
        return self

    def cancel(self):
        pass


txaio = types.ModuleType("txaio")
txaio.make_logger = lambda: _Log()
txaio.create_future = lambda result=None: result
txaio.resolve = lambda future, value=None: None
txaio.reject = lambda future, error=None: None
txaio.add_callbacks = (
    lambda future, callback=None, errback=None: callback(future) if callback else None
)
txaio.as_future = lambda fn, *args, **kwargs: fn(*args, **kwargs)
txaio.failure_format_traceback = lambda err: str(err)
txaio.call_later = lambda *args, **kwargs: _Timer()
txaio.make_batched_timer = lambda *args, **kwargs: _Timer()
txaio.time_ns = lambda: 0
txaio.use_asyncio = lambda: None
txaio.use_twisted = lambda: None
sys.modules["txaio"] = txaio

hyperlink = types.ModuleType("hyperlink")


class _URL:
    @classmethod
    def from_text(cls, text):
        return cls(text)

    def __init__(self, text):
        self._text = text

    def to_uri(self):
        return self

    def normalize(self):
        return self

    def to_text(self):
        return self._text


hyperlink.URL = _URL
sys.modules["hyperlink"] = hyperlink

wamp_types = types.ModuleType("autobahn.wamp.types")


class TransportDetails:
    pass


wamp_types.TransportDetails = TransportDetails
sys.modules["autobahn.wamp.types"] = wamp_types

sys.path.insert(0, SRC + "/src")

from autobahn.websocket.compress_deflate import PerMessageDeflate
from autobahn.websocket.protocol import WebSocketProtocol


class _Factory:
    isServer = True
   …

Record: PYSEC-2026-4031
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-77528 5.3

Record: UBUNTU-CVE-2026-77528
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11852-1 No score

python313-autobahn-26.7.1-2.1 on GA media

These are all security issues fixed in the python313-autobahn-26.7.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11852-1
Updated: 2026-11-02

Affected products

crossbario autobahn-python

Affected packages

Affected packages
Package	Affected	Fixed
`autobahn` PyPI	before 26.7.1	26.7.1
`crossbar` PyPI	before 26.7.1	26.7.1
`python-autobahn` Debian:12	All versions, plus listed versions 22.7.1+dfsg1-222.7.1+dfsg1-322.7.1+dfsg1-423.1.2+dfsg1-123.1.2+dfsg1-2 Show 5 moreShow less 24.4.2+dfsg1-124.4.2+dfsg1-224.4.2+dfsg1-324.4.2+dfsg1-424.4.2+dfsg1-5	None known
`python-autobahn` Debian:13	All versions, plus listed versions 23.1.2+dfsg1-224.4.2+dfsg1-124.4.2+dfsg1-224.4.2+dfsg1-324.4.2+dfsg1-424.4.2+dfsg1-5	None known
`python-autobahn` Debian:14	All versions, plus listed versions 23.1.2+dfsg1-224.4.2+dfsg1-124.4.2+dfsg1-224.4.2+dfsg1-324.4.2+dfsg1-424.4.2+dfsg1-5	None known
`autobahn` PyPI	before 26.7.1, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less 0.10.50.10.5.post20.10.60.10.70.10.80.10.90.11.00.12.00.12.10.13.00.13.10.14.00.14.10.15.00.16.00.16.10.17.00.17.10.17.20.18.00.18.10.18.20.3.10.3.20.4.00.4.10.4.100.4.20.4.30.5.00.5.10.5.140.5.20.5.50.5.80.5.90.6.30.6.40.6.50.7.00.7.10.7.20.7.30.7.40.8.0	26.7.1
`crossbar` PyPI	before 26.7.1, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less 0.11.00.11.10.11.20.12.10.13.00.13.10.13.20.14.00.15.00.8.10.8.20.8.30.9.00.9.0-20.9.0-30.9.0-40.9.0-50.9.0-60.9.0-70.9.10.9.100.9.110.9.120.9.12-20.9.20.9.30.9.40.9.4-20.9.4-30.9.50.9.60.9.6-20.9.70.9.7-20.9.7-30.9.7-40.9.7-50.9.7-60.9.80.9.8-20.9.8-30.9.8-40.9.8-50.9.916.10.0	26.7.1
`python-autobahn` Ubuntu:16.04:LTS	All versions, plus listed versions 0.10.3+dfsg1-20.10.3+dfsg1-30.10.3+dfsg1-5	None known
`python-autobahn` Ubuntu:18.04:LTS	All versions, plus listed versions 0.14.1+dfsg1-2ubuntu117.10.1+dfsg1-2	None known
`python-autobahn` Ubuntu:20.04:LTS	All versions, plus listed versions 17.10.1+dfsg1-517.10.1+dfsg1-6	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`python-autobahn` Ubuntu:22.04:LTS	All versions, plus listed versions 17.10.1+dfsg1-721.11.1+dfsg1-221.11.1+dfsg1-2build1	None known
`python-autobahn` Ubuntu:24.04:LTS	All versions, plus listed versions 22.7.1+dfsg1-322.7.1+dfsg1-4	None known
`python-autobahn` Ubuntu:26.10	All versions, plus listed versions 24.4.2+dfsg1-5	None known
`python-autobahn` Ubuntu:26.04:LTS	All versions, plus listed versions 23.1.2+dfsg1-224.4.2+dfsg1-424.4.2+dfsg1-5	None known
`python-autobahn` openSUSE:Tumbleweed	before 26.7.1-2.1	26.7.1-2.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77528 is a medium vulnerability (CVSS 5.3) in Crossbario Autobahn-python, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in autobahn 26.7.1.

References

Show 8 moreShow less

This page doesn't list everything

Left out here: 169 versions and the rest of 4 source descriptions. The JSON record has them.