Resource Exhaustion Flaw in Autobahn Python for WebSocket and WAMP Implementations

CVE-2026-77528

What is CVE-2026-77528?

Autobahn Python, a library for WebSocket and WAMP in Python, contains a vulnerability that affects its handling of compressed WebSocket frames. Specifically, before version 26.7.1, the library enforces the maximum message payload size on compressed frame lengths without properly checking the decompressed message size. This oversight allows a remote unauthenticated attacker to send a compressed frame that adheres to the wire size limit, but upon decompression exceeds the application's message size limit, leading to potential resource exhaustion. This issue allows oversized data to be allocated and processed in application callbacks, creating performance issues without compromising confidentiality or integrity. The vulnerability has been addressed in version 26.7.1.

References