{"id":"GHSA-pjh6-c8mg-3x7m","summary":"Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)","details":"### Summary\n\npermessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix.\n\n### Details\n\nIn 26.7.1 the receive path passes the remaining `maxMessagePayloadSize` budget to `decompress_message_data(..., max_output_len=...)`. deflate and bzip2 stop at that budget. `PerMessageBrotli.decompress_message_data` (`compress_brotli.py`) instead calls `self._decompressor.process(data)` with no limit and compares the length afterwards, so the whole frame is inflated first.\n\nThe code comment and changelog say this is still \"bounded on the wire by `maxFramePayloadSize`\", but brotli reaches about 1,000,000:1 (841 bytes inflate to 1 GiB), so that bound means little. A 421-byte frame against a 1 MiB budget peaks at 545 MiB before the 1009 rejection.\n\nAn autobahn asyncio server on 127.0.0.1 accepting permessage-brotli, with `maxFramePayloadSize=64 KiB` and `maxMessagePayloadSize=1 MiB`, received one small brotli frame from an autobahn client and peaked at 545 MiB (baseline 28 MiB). A few concurrent connections can exhaust memory.\n\nbrotli ≥ 1.2.0 has `Decompressor.process(data, output_buffer_limit=N)`, so the backend can stop at `max_output_len` like deflate and bzip2 (and the extra's floor can be raised to `brotli\u003e=1.2.0`).\n\nTested on autobahn 26.7.1 (latest) with brotli 1.2.0; `compress_brotli.py` on master is unchanged. This affects servers that enable permessage-brotli (opt-in, needs the `compress` extra).\n\n### Proof of concept\n\nHow to run the PoC\n```\npython3 -m venv venv && . venv/bin/activate\npip install autobahn==26.7.1 brotli==1.2.0\npython3 poc_autobahn.py\n```\n\n```python\n# PoC: autobahn 26.7.1 permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked.\nimport brotli, resource\nfrom autobahn.websocket.compress import PerMessageBrotli\n\nc = brotli.Compressor()  # build a 256 MiB-of-zeros frame without holding the plaintext\nframe = b\"\".join(c.process(b\"\\0\" * (1 \u003c\u003c 20)) for _ in range(256)) + c.finish()\npmce = PerMessageBrotli(is_server=True, server_no_context_takeover=False, client_no_context_takeover=False)\npmce.start_decompress_message()\nprint(len(frame), \"bytes on the wire; peak RSS before:\", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss \u003e\u003e 10, \"MiB\")\ntry:\n    pmce.decompress_message_data(frame, max_output_len=1 \u003c\u003c 20)  # remaining budget: 1 MiB\nexcept Exception as e:\n    print(type(e).__name__, \"| peak RSS after:\", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss \u003e\u003e 10, \"MiB\")\n```\n\nOutput:\n```\n421 bytes on the wire; peak RSS before: 36 MiB\nPayloadExceededError | peak RSS after: 545 MiB\n```\n\n### Impact\n\nAn unauthenticated WebSocket client can make a server that enabled permessage-brotli allocate hundreds of MB or more per tiny frame, regardless of the configured `maxMessagePayloadSize`. That is the memory-exhaustion DoS GHSA-hxp9-w8x3-p566 was meant to prevent.\n\nCredit goes to Adrian Korwel.","aliases":["CVE-2026-116579"],"modified":"2026-10-28T21:30:06.702115297Z","published":"2026-10-28T21:10:17Z","database_specific":{"github_reviewed_at":"2026-10-28T21:10:17Z","nvd_published_at":"2026-10-26T21:18:15Z","cwe_ids":["CWE-409","CWE-770"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116579"},{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/pull/1987"},{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1"},{"type":"PACKAGE","url":"https://github.com/crossbario/autobahn-python"},{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/releases/tag/v26_10_1"}],"affected":[{"package":{"name":"autobahn","ecosystem":"PyPI","purl":"pkg:pypi/autobahn"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.1"},{"fixed":"26.10.1"}]}],"versions":["26.7.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pjh6-c8mg-3x7m/GHSA-pjh6-c8mg-3x7m.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}