CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

• CWE-409
• CWE-770

• https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1
• https://github.com/crossbario/autobahn-python/pull/1987
• https://github.com/crossbario/autobahn-python/releases/tag/v26_10_1
• https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m

Published

Oct 26, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116566socket.getaddrinfo() previously accepted null bytes within *…5.3
• CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to …8.8
• CVE-2026-116575Mem0 provides persistent memory infrastructure for AI agents…6.3
• CVE-2026-116576systeminformation is a System and OS information library for…7.8
• CVE-2026-116577Tornado is a Python web framework and asynchronous networkin…5.3
• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3
• CVE-2026-116584Seroval facilitates JavaScript value stringification, includ…7.5