CVE-2026-77528: Autobahn Python permessage-deflate Bypass of maxMessagePayloadSize After Inflation
Summary
CVE-2026-77528: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation. Affects autobahn versions < 26.7.1. Fixed in 26.7.1. How to fix ↓
Also tracked for
- crossbar · PyPI
The same CVE-2026-77528 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Autobahn is a popular Python library that provides WebSocket and WAMP (Web Application Messaging Protocol) support. It enables real-time communication between clients and servers, facilitating the development of interactive applications. The library supports features such as permessage-deflate for message compression, enhancing performance and reducing bandwidth usage. However, a vulnerability exists that allows inflated messages to bypass configured size limits, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability arises from the way Autobahn handles compressed WebSocket frames. It enforces the maxMessagePayloadSize limit on the compressed length of messages but fails to check the size after inflation. This means that a client can send a small compressed message that, when inflated, exceeds the configured size limit, allowing the application to process excessively large messages. This can lead to resource exhaustion, as the application may allocate more memory than intended, impacting performance and stability.
How To Fix
Latest published version: 26.10.2 as of 23 Oct 2026
pip install --upgrade "autobahn==26.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.7.1
This is the first release that contains the fix.
pip install --upgrade "autobahn==26.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the size of messages after they are inflated. This can help mitigate the risk until the package is updated. However, the best solution is to apply the patch provided in the latest version of Autobahn.
Conclusion
The CVE-2026-77528 vulnerability in the Autobahn Python library poses a risk of resource exhaustion due to improper handling of inflated WebSocket messages. It is crucial for developers using this library to update to the patched version to ensure their applications remain secure. Implementing additional checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for autobahn →
FAQ
CVE-2026-77528 is a vulnerability in the Autobahn Python library that allows inflated WebSocket messages to bypass size limits, potentially leading to resource exhaustion.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package, implement additional size checks in your application to validate inflated message sizes as a temporary measure.
You can find more information about Autobahn and its features on its official documentation page or GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for autobahn.
