CVE-2026-77528: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 bytes and reach onMessage even when the application configured a 128-byte message limit, defeating the resource boundary the option is meant to provide.
References
- github.com/advisories/GHSA-hxp9-w8x3-p566
- github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613
- github.com/crossbario/autobahn-python/pull/1916
- github.com/crossbario/autobahn-python/releases/tag/v26_7_1
- github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
- nvd.nist.gov/vuln/detail/CVE-2026-77528
Code Behaviors & Features
Detect and mitigate CVE-2026-77528 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →