CVE-2026-77528: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 bytes and reach onMessage even when the application configured a 128-byte message limit, defeating the resource boundary the option is meant to provide.
References
- github.com/advisories/GHSA-hxp9-w8x3-p566
- github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613
- github.com/crossbario/autobahn-python/pull/1916
- github.com/crossbario/autobahn-python/releases/tag/v26_7_1
- github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
- nvd.nist.gov/vuln/detail/CVE-2026-77528
Code Behaviors & Features
Detect and mitigate CVE-2026-77528 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →