Skip to content
Fencer Vulns
medium 5.9

CVE-2026-116579 json

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

published 2026-10-26 13 d ago modified 2026-10-28 11 d ago also GHSA-pjh6-c8mg-3x7m , EUVD-2026-110320

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

Patch / fix

  • pypi autobahn 26.10.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-116579 updated cvss 5.9

autobahn: autobahn: Denial of Service via uncontrolled Brotli decompression

  • Red Hat Ansible Automation Platform 2 python-autobahn 23.1.2-1.el9ap, python3x-autobahn 23.1.2-1.el8ap, python3.11-autobahn 24.4.2-1.el9ap, python3.12-autobahn 24.4.2-2.el9ap, automation-controller 4.7.18-1.el9ap, ansible-automation-platform-24/controller-rhel8, +8 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 python3-autobahn
    affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
12 d ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi autobahn
>=26.7.1, <26.10.1
26.10.1

Affected products

  • crossbario autobahn-python

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.