Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

nucypher (2.0.0b7), rexsio-agent (>=0.0.1, <=0.0.8) potentially affected by CVE-2026-77528 via autobahn (20.2.1)

autobahn PYPI version 20.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - nucypher 2.0.0b7 - rexsio-agent =0.0.1, =0.0.8 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

PYSEC-2026-4031 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

aiorest-ws (>=1.1.0, <=1.1.1) potentially affected by CVE-2026-77528 via autobahn (0.16.0)

autobahn PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - aiorest-ws =1.1.0, =1.1.1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

paps-settings (>=0.2.4a0, <=0.2.6a0) potentially affected by CVE-2026-77528 via autobahn (0.13.1)

autobahn PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - paps-settings =0.2.4a0, =0.2.6a0 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

nucypher (2.1.0b2) potentially affected by CVE-2026-77528 via autobahn (20.4.1)

autobahn PYPI version 20.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - nucypher 2.1.0b2 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

compas-cloud (>=0.1.2rc1, <=0.3.3), evennia (>=1.0.0, <=6.1.0) +8 more potentially affected by CVE-2026-77528 via autobahn (20.12.3)

autobahn PYPI version 20.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - compas-cloud =0.1.2rc1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =4.5.2, =1.0.2, =1.0.9 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-402...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (>=1.5.0, <=1.10.0) +1 more potentially affected by CVE-2026-77528 via autobahn (21.2.1)

autobahn PYPI version 21.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - binance-connector =1.5.0, =1.5.0, =1.6.1, =1.6.2 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

miniature-lighting-desk (>=0.1.0, <=0.1.1), netmagus (1.0.0) +2 more potentially affected by CVE-2026-77528 via autobahn (21.11.1)

autobahn PYPI version 21.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - miniature-lighting-desk =0.1.0, =1.0.10, =1.1.2 - workoutizer 0.24.0 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

nucypher (2.1.0b1) potentially affected by CVE-2026-77528 via autobahn (20.3.1)

autobahn PYPI version 20.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - nucypher 2.1.0b1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

nucypher (>=2.1.0b3, <=2.1.0b12) potentially affected by CVE-2026-77528 via autobahn (20.4.3)

autobahn PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - nucypher =2.1.0b3, =2.1.0b12 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

bittensor (>=1.0.0, <=1.0.4), hazard-feed (>=0.2.0, <=0.2.5) +1 more potentially affected by CVE-2026-77528 via autobahn (20.7.1)

autobahn PYPI version 20.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - bittensor =1.0.0, =0.2.0, =3.0.0b0, =4.4.0 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

ezbeq (>=0.5.3, <=1.0.0b1), fc-guarder (>=0.6.6, <=0.7.8) +7 more potentially affected by CVE-2026-77528 via autobahn (21.3.1)

autobahn PYPI version 21.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - ezbeq =0.5.3, =0.6.6, =0.6.6, =0.0.1.dev15, =23.0.1, =0.8.0b1, =0.0.10, =0.0.2, =0.18.0, =0.23.0 Source cves: CVE-2026-77528 Source advisory:...

autobahntestsuite (>=0.8.0, <=0.8.2) potentially affected by CVE-2026-77528 via autobahn (0.10.9)

autobahn PYPI version 0.10.9 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - autobahntestsuite =0.8.0, =0.8.2 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

PYSEC-2026-4027 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

golemrpc (>=0.3.4, <=0.3.6) potentially affected by CVE-2026-77528 via autobahn (18.10.1)

autobahn PYPI version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - golemrpc =0.3.4, =0.3.6 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

engel (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-77528 via autobahn (0.13.0)

autobahn PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - engel =0.3.0, =0.3.1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

crossbar (17.3.1) potentially affected by CVE-2026-77528 via autobahn (0.18.1)

autobahn PYPI version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - crossbar 17.3.1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

paradrop (>=0.13.2, <=0.13.3a8) potentially affected by CVE-2026-77528 via autobahn (18.8.1)

autobahn PYPI version 18.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - paradrop =0.13.2, =0.13.3a8 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...