89 matches found
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...
CVE-2026-77528
creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:23+00:00| published-proof-of-concept| https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566...
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...
GHSA-HXP9-W8X3-P566 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...
EUVD-2026-83415
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation...
OPENSUSE-SU-2026:11852-1 python313-autobahn-26.7.1-2.1 on GA media
These are all security issues fixed in the python313-autobahn-26.7.1-2.1 package on the GA media of openSUSE Tumbleweed...
Linux Distros Unpatched Vulnerability : CVE-2026-77528
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the maxMessagePayloadSize limit is enforced against the compressed wire size of a permessage-compressed WebSocket frame rather than...
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
DEBIAN-CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
UBUNTU-CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528
Autobahn Python (a WebSocket and WAMP implementation for Python supporting Twisted and asyncio) contains a vulnerability prior to version 26.7.1 in its permessage-deflate handling. When a WebSocket endpoint enforces maxMessagePayloadSize , the limit is checked against the compressed frame length ...
CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...
CVE-2026-77528: Improper Handling of Highly Compressed Data (Data Amplification)
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...