CVE-2026-116579 with a CVSS score of 5.9 is a memory exhaustion denial-of-service vulnerability in the Autobahn Python WebSocket server's permessage-brotli decompression path. The affected software is autobahn (pip) versions >= 26.7.1, < 26.10.1. The flaw occurs because the permessage-brotli decompressor processes an entire compressed frame before comparing the resulting plaintext length against the configured maxMessagePayloadSize limit, unlike deflate and bzip2 handling that can stop at the output budget. As a result, a very small network frame can expand to hundreds of megabytes before the server rejects it, even when a one-megabyte message limit is configured. An unauthenticated remote attacker can exploit this by sending a crafted permessage-brotli WebSocket frame to a server that has opted into permessage-brotli compression, requiring the compress extra and a server configuration that accepts the extension. The attack does not require authentication or user interaction, but it depends on the vulnerable compression path being enabled. The business impact is that a few concurrent connections can consume large amounts of server memory, causing performance degradation, service interruption, or denial of service for legitimate WebSocket clients.
We recommend you to update Autobahn Python to version 26.10.1.[/subscribe_to_unlock_form]
CVE-2026-116579 with a CVSS score of 5.9 is a memory exhaustion denial-of-service vulnerability in the Autobahn Python WebSocket server's permessage-brotli decompression path. The affected software is autobahn (pip) versions >= 26.7.1, < 26.10.1. The flaw occurs because the permessage-brotli decompressor processes an entire compressed frame before comparing the resulting plaintext length against the configured maxMessagePayloadSize limit, unlike deflate and bzip2 handling that can stop at the output budget. As a result, a very small network frame can expand to hundreds of megabytes before the server rejects it, even when a one-megabyte message limit is configured. An unauthenticated remote attacker can exploit this by sending a crafted permessage-brotli WebSocket frame to a server that has opted into permessage-brotli compression, requiring the compress extra and a server configuration that accepts the extension. The attack does not require authentication or user interaction, but it depends on the vulnerable compression path being enabled. The business impact is that a few concurrent connections can consume large amounts of server memory, causing performance degradation, service interruption, or denial of service for legitimate WebSocket clients.
We recommend you to update Autobahn Python to version 26.10.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]