PT-2026-138765

These are all security issues fixed in the python313-autobahn-26.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12439-1 python313-autobahn-26.11.1-1.1 on GA media

These are all security issues fixed in the python313-autobahn-26.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

Autobahn Python: Permessage-brotli Inflates A Whole Frame Before MaxMessagePayloadSize Is Checked (incomplete Fix Of GHS

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

GHSA-PJH6-C8MG-3X7M Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...

django-whiteneuron (>=0.2.48.2, <=0.3.1.2), faradaysec (>=4.1.0, <=4.4.1) +13 more potentially affected by CVE-2026-116579 via autobahn (26.7.1)

autobahn PYPI version 26.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - django-whiteneuron =0.2.48.2, =4.1.0, =3.11.3, =1.10.0, =1.0.0, =1.2.0, =1.2.0, =0.3.0b0, =4.4.0, =1.0.0.12, =2.8.3, =2.8.4 Source cves:...

django-whiteneuron (>=0.2.48.2, <=0.3.1.2), faradaysec (>=4.1.0, <=4.4.1) +13 more potentially affected by CVE-2026-116579 via autobahn (26.7.1)

autobahn PYPI version 26.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - django-whiteneuron =0.2.48.2, =4.1.0, =3.11.3, =1.10.0, =1.0.0, =1.2.0, =1.2.0, =0.3.0b0, =4.4.0, =1.0.0.12, =2.8.3, =2.8.4 Source cves:...

EUVD-2026-110320

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked incomplete fix of GHSA-hxp9-w8x3-p566...

SUSE CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

Linux Distros Unpatched Vulnerability : CVE-2026-116579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1,...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116579

A flaw was found in autobahn. An unauthenticated remote attacker can exploit this vulnerability by sending a small, highly compressed WebSocket message to a server configured with Brotli compression. Because decompression occurs without enforcing an output size limit during processing, the payloa...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the decompressmessagedata method of the permessage-brotli and other permessage- compression extensions, which inflates an entire compressed frame into memory before...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

UBUNTU-CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116579

The Autobahn Python WebSocket and WAMP implementation for Python (versions 26.7.1 to 26.10.1 ) contains a vulnerability in the PerMessageBrotli.decompress_message_data function within compress_brotli.py . The root cause is that the Brotli decompressor is called without an output limit, and the ma...

CVE-2026-116579 Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116579 Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...