ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116579

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116579. EPSS is 0.43%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium5.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Version ranges on file
Affected products
pip autobahn · pypi autobahn

### Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. ### Details In 26.7.1 the receive path passes the remaining budget to . deflate and bzip2 stop at that budget. ( ) instead calls with no limit and compares the length afterwards, so the whole frame is inflated first. The code comment and changelog say this is still "bounded on the wire by ", but brotli reaches about 1,000,000:1 (841 bytes inflate to 1 GiB), so that bound means little. A 421-byte frame against a 1 MiB budget peaks at 545 MiB before the 1009 rejection. An autobahn asyncio server on 127.0.0.1 accepting permessage-brotli, with and , received one small brotli frame from an autobahn client and peaked at 545 MiB (baseline 28 MiB). A few concurrent connections can exhaust memory. brotli ≥ 1.2.0 has , so the backend can stop at like deflate and bzip2 (and the extra's floor can be raised to ). Tested on autobahn 26.7.1 (latest) with brotli 1.2.0; on master is unchanged. This affects servers that enable permessage-brotli (opt-in, needs the extra). ### Proof of concept How to run the PoC Output: ### Impact An unauthenticated WebSocket client can make a server that enabled permessage-brotli allocate hundreds of MB or more per tiny frame, regardless of the configured . That is the memory-exhaustion DoS GHSA-hxp9-w8x3-p566 was meant to prevent. Credit goes to Adrian Korwel.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip autobahn>= 26.7.1, < 26.10.1
  • pypi autobahnversion unspecified

How to fix CVE-2026-116579

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116579. EPSS is 0.43%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with >= 26.7.1, < 26.10.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-409; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    autobahn: autobahn: Denial of Service via uncontrolled Brotli decompression

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix. ### Details In 26.7.1 the re

Sources

  • CVE.orgVulnerability recordCVE-2026-116579

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-pjh6-c8mg-3x7m

    Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116579

    permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix.

    advisories.gitlab.com
  • Red Hat Security DataVendor advisoryCVE-2026-116579

    autobahn: autobahn: Denial of Service via uncontrolled Brotli decompression

    access.redhat.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 29, 2026
  • CVE.orgOct 27, 2026
  • Red Hat Security DataOct 27, 2026