Linux Distros Unpatched Vulnerability : CVE-2026-77528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept...

Fedora 46 : python-streamlink / python-urllib3 (2026-3a61bdd470)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3a61bdd470 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

DEBIAN-CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

UBUNTU-CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528

Autobahn Python (a WebSocket and WAMP implementation for Python supporting Twisted and asyncio) contains a vulnerability prior to version 26.7.1 in its permessage-deflate handling. When a WebSocket endpoint enforces maxMessagePayloadSize , the limit is checked against the compressed frame length ...

CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528: Improper Handling of Highly Compressed Data (Data Amplification)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

PT-2026-95665

Name of the Vulnerable Software and Affected Versions Autobahn Python versions prior to 26.7.1 Description WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce the limit against the compressed frame length before inflation but fail to recheck the decompress...

MiracleLinux 9 : libsoup-2.72.0-16.el9_8.3 (AXSA:2026-1872:12)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1872:12 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsou...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

GHSA-GQ9C-WMRM-5HVR HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

Summary SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage...

EUVD-2026-80993

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service...

GHSA-3W98-RRPR-FPRR HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

Summary SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...