{"id":"CVE-2026-77528","summary":"Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation","details":"Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.","aliases":["GHSA-hxp9-w8x3-p566"],"modified":"2026-09-20T11:47:26.982915960Z","published":"2026-09-18T19:42:18.767Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77528.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-409","CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77528.json"},{"type":"ADVISORY","url":"https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77528"},{"type":"FIX","url":"https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613"},{"type":"FIX","url":"https://github.com/crossbario/autobahn-python/pull/1916"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crossbario/autobahn-python","events":[{"introduced":"0"},{"fixed":"77d323a30b09b1828ad8be2ce6344e056970e613"},{"fixed":"22055b5a3b0e92307e348010260d775dec05be8c"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"26.7.1"}]}}],"versions":["fork_9802eefc_oberstet_autobahn_python_fix_1911_202607150923","fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609","fork-9802eefc-oberstet_autobahn_python-fix_1911-202607150923","fork_62ed99c3_oberstet_autobahn_python_fix_1910_202607142014","fork-62ed99c3-oberstet_autobahn_python-fix_1910-202607142014","fork-65566044-oberstet_autobahn_python-fix_1909-202607141831","fork_07694ec9_oberstet_autobahn_python_fix_1908_202607141156","fork-fe7f7843-oberstet_autobahn_python-fix_1909-202607141627","fork-cd154a01-oberstet_autobahn_python-fix_1909-202607141552","fork-07694ec9-oberstet_autobahn_python-fix_1908-202607141156","master-202607021552","fork_9811e7ed_oberstet_autobahn_python_fix_1875_202607012209","fork-ae666ac5-oberstet_autobahn_python-fix_1877-202607021413","fork-9811e7ed-oberstet_autobahn_python-fix_1875-202607012209","fork-725dbb0e-oberstet_autobahn_python-fix_1877-202607021131","fork_bc964141_oberstet_autobahn_python_fix_1840_202607011813","fork-bc964141-oberstet_autobahn_python-fix_1840-202607011813","master-202607011745","master-202606251624","fork-402c2509-oberstet_autobahn_python-fix_1891-202607011603","v26_6_2","v26.6.2","fork-5a9fad09-oberstet_autobahn_python-fix_1878-202606191302","v26_6_1","v26.6.1","master-202606171850","fork-783a1c67-oberstet_autobahn_python-fix_1830-202606171555","fork_3b5ec0b2_oberstet_autobahn_python_fix_1850_202606170939","fork-914bd9b2-oberstet_autobahn_python-fix_1831-202606171139","fork-3b5ec0b2-oberstet_autobahn_python-fix_1850-202606170939","master-202606170853","master-202606162003","fork-a948beaa-oberstet_autobahn_python-fix_1848-202606170741","fork-c6f15fe8-oberstet_autobahn_python-fix_1859-202606161345","master-202601101042","fork-68427734-oberstet_autobahn_python-strict_typing_test-202601141357","master-202601091234","fork-cee77a0c-bblommers_autobahn_python-chore_apply_ruff_up-202601092138","v25_12_2","v25.12.2","master-202512150825","fork-336ed2fc-bblommers_autobahn_python-websocket_server_typing-202601090018","master-202512150317","master-202512111855","master-202512111854","fork-7ce4f0c4-oberstet_autobahn_python-sync_autobahn_zlmdb-202512132337","fork-4e490deb-oberstet_autobahn_python-sync_autobahn_zlmdb-202512132101","master-202512111629","master-202512111101","master-202512111100","v25.12.1","master-202512100151","v25_12_1","master-202512092131","master-202512092130","master-202512090545","master-202512051011","master-202512051009","fork-a52fc8dc-oberstet_autobahn_python-modernization_phase_1_4-202512051755","fork-59ec5a2a-oberstet_autobahn_python-modernization_phase_1_4-202512090529","master-202512050044","master-202512040348","fork-95d12097-oberstet_autobahn_python-rel25_12_1-202512050325","fork-6fb87ff8-oberstet_autobahn_python-rel25_12_1-202512050109","fork-d5809869-oberstet_autobahn_python-modernization_phase_1_3-202512022045","fork-3ec72f9a-oberstet_autobahn_python-modernization_phase_1_3-202512032120","master-202511251629","fork-a1ab19e6-oberstet_autobahn_python-modernization_phase_1_2-202511252215","fork-8aa7597f-oberstet_autobahn_python-modernization_phase_1_2-202511270116","fork-563b7509-oberstet_autobahn_python-modernization_phase_1_2-202511260144","fork-46bb48f1-oberstet_autobahn_python-modernization_phase_1_2-202511260912","master-202511240823","fork_0ecde788_oberstet_autobahn_python_fix_1771_complete_202511240810","fork-3b89d6f6-oberstet_autobahn_python-modernization_phase_1_1-202511251607","fork-0edf53d3-oberstet_autobahn_python-modernization_phase_1_1-202511251452","fork-0ecde788-oberstet_autobahn_python-fix_1771_complete-202511240810","master-202511240707","master-202511210958","master-202511210957","fork-b3706c84-oberstet_autobahn_python-fix_1771-202511222354","fork-6b8dd1d8-oberstet_autobahn_python-fix_1771-202511240252","master-202511210011","fork-e20b27c3-oberstet_autobahn_python-fix_1767-202511210942","master-202511111724","master-202511111723","fork-fba06933-oberstet_autobahn_python-fix_1764-202511141246","fork-dde8d1e8-oberstet_autobahn_python-fix_1764-202511140104","fork-c6c0917f-oberstet_autobahn_python-fix_1764-202511202102","fork-c49eef15-oberstet_autobahn_python-fix_1764-202511172337","fork-bf11bedf-oberstet_autobahn_python-fix_1764-202511171908","fork-b9d85017-oberstet_autobahn_python-fix_1764-202511172306","fork-99653ffe-oberstet_autobahn_python-fix_1764-202511202336","fork-8dc09597-oberstet_autobahn_python-fix_1764-202511150024","fork-7970856c-oberstet_autobahn_python-fix_1764-202511142209","fork-48d16019-oberstet_autobahn_python-fix_1764-202511130000","fork-1961e25d-oberstet_autobahn_python-fix_1764-202511171648","fork-11332fbb-oberstet_autobahn_python-fix_1764-202511172142","fork-0685103f-oberstet_autobahn_python-fix_1764-202511132221","fork-047f5821-oberstet_autobahn_python-fix_1764-202511200000","fork-d1242642-oberstet_autobahn_python-fix_1760-202511111451","fork-ca7875f5-oberstet_autobahn_python-fix_1760-202511111137","fork-c6c33541-oberstet_autobahn_python-fix_1760-202511111620","fork-5c023b9c-oberstet_autobahn_python-fix_1760-202511111319","fork-08262228-oberstet_autobahn_python-fix_1760-202511111707","master-202511102153","master-202511081609","fork-3af8cd9e-oberstet_autobahn_python-fix_1757-202511102055","fork-3a671563-oberstet_autobahn_python-fix_1757-202511102019","master-202511081228","master-202511081227","v25.10.2","v25_10_2","master-202510222109","master-202510222108","master-202510221912","fork-de4c5238-oberstet_autobahn_python-rel_v25_10_2_part2-202510222024","fork-de4c5238-oberstet_autobahn_python-rel_v25_10_2_part2-202510222023","master-202510221810","master-202510221134","master-202510221133","master-202510201326","fork-e431e88e-oberstet_autobahn_python-rel_v25_10_2-202510210040","fork-12305151-oberstet_autobahn_python-rel_v25_10_2-202510202247","v25.10.1","master-202510200138","master-202510191601","v25_10_1","master-202510182244","master-202510181644","master-202510181550","master-202510180801","master-202510180103","v25.9.1","fork-c5313953-oberstet_autobahn_python-rel_v25_10_1_part1-202510161046","fork-a92b17a0-oberstet_autobahn_python-rel_v25_10_1_part1-202510171227","fork-9aa0bd54-oberstet_autobahn_python-rel_v25_10_1_part1-202510162031","fork-9191a642-oberstet_autobahn_python-rel_v25_10_1_part1-202510161444","fork-76cd10f3-oberstet_autobahn_python-rel_v25_10_1_part1-202510152023","fork-5fed10a3-oberstet_autobahn_python-rel_v25_10_1_part1-202510162052","fork-5550a0c3-oberstet_autobahn_python-rel_v25_10_1_part1-202510162022","fork-0f506ae4-oberstet_autobahn_python-rel_v25_10_1_part1-202510160939","v25_9_1","master-202510151247","fork-72913a4b-oberstet_autobahn_python-rel_v25_9_1_part5c-202510151335","master-202510151146","fork-95458ae8-oberstet_autobahn_python-rel_v25_9_1_part5c-202510151212","master-202510150311","master-202510150228","fork-db8dd82d-oberstet_autobahn_python-rel_v25_9_1_part5c-202510150241","pr1698-null-rel_v25_9_1_part5c-202510142013","master-202510142011","fork-388b60f4-oberstet_autobahn_python-rel_v25_9_1_part5c-202510142027","master_202510130730","master-202510130731","master-202510130730","fork-f8a785d9-oberstet_autobahn_python-rel_v25_9_1_part5b-202510141950","fork-d47799a9-oberstet_autobahn_python-rel_v25_9_1_part5b-202510141842","fork-a6901e83-oberstet_autobahn_python-rel_v25_9_1_part5b-202510132229","master_202510111957","master-202510111958","master-202510111957","master-202510111643","master-202510111432","master-202510111405","master-202510111248","master-202510111216","master-202510111215","master-202510111202","master-202510111201","master-202510111146","master-202510111145","master-202510111122","master-202510111121","master-202510110103","master-202510110102","master_202510102120","master-202510102120","wheels-docker-20251007-980727a0","wheels-20251007-980727a0246ca77c187b83811572b567b3bb6e3c","wheels-docker-20251007-4691a2b0","wheels-20251007-4691a2b044bd3de73ae03aa20a0240ee4a127c66","wheels-docker-20251004-12c36f19","wheels-20251004-12c36f1968f26c4834f7a6b6d6bab1c5a36fcd47","wheels-docker-20250928-dbf5d6fe","wheels-20250928-dbf5d6feae43b99a2620848dc70f5a2ef4cd2aa7","wheels-docker-20250920-7dbac37c","wheels-20250920-7dbac37c","wheels-20250920-ec9e4274","v24.4.2","v23.6.2","v23.6.1","v23.1.2","v23.1.1","v22.12.1","v22.7.1","v22.6.1","v22.5.1","v22.4.2","v22.4.1","v22.3.2","v22.3.1","v22.2.2","v22.2.1","v22.1.1","v21.11.1","v21.3.1","v21.2.2","v21.2.1","v21.1.1","v20.12.3","v20.12.2","v20.12.1","v20.7.1","v20.6.2","v20.6.1","v20.4.3","v20.4.2","v20.4.1","v20.3.1","v20.2.2","v20.2.1","v20.1.3","v20.1.2","v20.1.1","v19.11.1","v19.10.1","v19.9.3","v19.9.2","v19.9.1","v19.8.1","v19.7.1","v19.6.2","v19.6.1","v19.5.1","19.3.3","v19.3.2","v19.3.1","v19.2.1","v19.1.1","v18.12.1","v18.11.2","v18.11.1","v18.5.2","v18.5.1","v18.3.1","v17.10.1","v17.9.3","v17.9.2","v17.9.1","v17.8.1","v17.7.1","v17.6.1","v17.5.1","v0.18.2","v0.18.0","v0.17.2","v0.17.1","v0.17.0","v0.16.1","v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.1","v0.13.0","v0.12.1","v0.12.0","v0.11.0","v0.10.9","v0.10.8","v0.10.7","v0.10.6","v0.10.5-2","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.6","v0.9.5","v0.9.4-2","v0.9.4","v0.9.3-3","v0.9.3-2","v0.9.3","v0.9.2","v0.9.0","v0.8.15","v0.8.14","v0.8.13","v0.8.12-2","v0.8.10","v0.8.9","v0.8.8","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.4","v0.7.3","v0.7.2","v0.6.5","v0.6.4","v0.6.3","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.2","v0.5.1","v0.5.0","v0.4.10","v0.4.3","v0.4.1","v0.4.0","v0.3.1","v0.3","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77528.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}