CVE-2026-77528: Autobahn Python permessage-deflate Bypass of maxMessagePayloadSize After Inflation
Summary
CVE-2026-77528: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation. Affects autobahn versions < 26.7.1. Fixed in 26.7.1. How to fix ↓
Also tracked for
- crossbar · PyPI
The same CVE-2026-77528 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Autobahn is a popular Python library that provides WebSocket and WAMP (Web Application Messaging Protocol) functionality. It enables real-time communication between clients and servers, allowing for efficient data exchange. The library supports features like permessage-deflate, which compresses WebSocket messages to optimize bandwidth usage. However, it has a vulnerability that allows inflated messages to exceed configured size limits, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability arises from Autobahn's handling of compressed WebSocket frames. It enforces the maxMessagePayloadSize limit only on the compressed frame length, failing to check the size of the inflated message before delivering it to application callbacks. This oversight allows an attacker to send a small compressed frame that, when inflated, exceeds the configured message size limit, leading to potential resource exhaustion and denial of service. The issue is similar to a previous vulnerability (CVE-2016-10544) where the compressed size check was incorrectly treated as a boundary for the decompressed message.
How To Fix
Latest published version: 26.10.2 as of 23 Oct 2026
pip install --upgrade "autobahn==26.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.7.1
This is the first release that contains the fix.
pip install --upgrade "autobahn==26.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the size of incoming messages after inflation. This can be done by modifying your message handling logic to include a size validation step before processing the message.
Conclusion
The CVE-2026-77528 vulnerability in the Autobahn Python library poses a risk of resource exhaustion due to improper handling of inflated WebSocket messages. It is crucial to update to the patched version 26.7.1 or later to ensure your application is secure. Additionally, implementing temporary workarounds can help mitigate the risk until an update can be applied.
See every vulnerability recorded for autobahn →
FAQ
CVE-2026-77528 is a vulnerability in the Autobahn Python library that allows inflated WebSocket messages to bypass size limits, potentially leading to resource exhaustion.
If your application uses Autobahn and accepts permessage-deflate offers, it may be vulnerable to this issue, allowing attackers to send oversized messages that can exhaust server resources.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider implementing additional size checks in your application to mitigate the risk of oversized messages.
References
Related vulnerabilities
Recent vulnerabilities recorded for autobahn.
