Skip to content
Fencer Intel
medium 5.9

CVE-2026-116579 json

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

published 14d ago modified 12d ago also EUVD-2026-110320 , GHSA-pjh6-c8mg-3x7m

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

Patch / fix

  • pypi autobahn 26.10.1
  • crossbar autobahn 26.10.1

Is CVE-2026-116579 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-116579 updated cvss 5.9

autobahn: autobahn: Denial of Service via uncontrolled Brotli decompression

  • Red Hat Ansible Automation Platform 2 python-autobahn 23.1.2-1.el9ap, python3x-autobahn 23.1.2-1.el8ap, python3.11-autobahn 24.4.2-1.el9ap, python3.12-autobahn 24.4.2-2.el9ap, automation-controller 4.7.18-1.el9ap, ansible-automation-platform-24/controller-rhel8, +8 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 python3-autobahn
    affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
13d ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi autobahn
>=26.7.1, <26.10.1
26.10.1

Affected products

  • crossbario autobahn-python

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.