CVE-2026-77528

Compressed WS frames can bypass payload limit, causing resource exhaustion.

• CVSS 5.3
• 409
• Resource Management
• Remote

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

CVE

CVE-2026-77528

CWE

409

CVSS base score

5.3

Published

2026-09-18

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Autobahn Python

Fixed by upgrading

Yes

Solution

Upgrade Autobahn Python to version 26.7.1 (or newer).

import asyncio
from autobahn.asyncio.websocket import WebSocketServerFactory, WebSocketServerProtocol

class EchoProtocol(WebSocketServerProtocol):
    # VULNERABLE: missing decompressed size check
    async def onMessage(self, payload, isBinary):
        await self.sendMessage(payload, isBinary)

def start_server():
    factory = WebSocketServerFactory("ws://localhost:9000")
    factory.maxMessagePayloadSize = 1024 * 1024  # 1 MiB
    factory.protocol = EchoProtocol
    loop = asyncio.get_event_loop()
    coro = loop.create_server(factory, '0.0.0.0', 9000)
    server = loop.run_until_complete(coro)
    loop.run_forever()

import asyncio
from autobahn.asyncio.websocket import WebSocketServerFactory, WebSocketServerProtocol

class EchoProtocol(WebSocketServerProtocol):
    # FIX: enforce payload size after inflation
    async def onMessage(self, payload, isBinary):
        if len(payload) > self.factory.maxMessagePayloadSize:
            await self.sendClose(1009, "Message too big")
            return
        await self.sendMessage(payload, isBinary)

def start_server():
    factory = WebSocketServerFactory("ws://localhost:9000")
    factory.maxMessagePayloadSize = 1024 * 1024  # 1 MiB
    factory.protocol = EchoProtocol
    loop = asyncio.get_event_loop()
    coro = loop.create_server(factory, '0.0.0.0', 9000)
    server = loop.run_until_complete(coro)
    loop.run_forever()

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202677528,
  title        = {{Compressed WS frames can bypass payload limit, causing resource exhaustion.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-77528},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-77528/}}
}