Autobahn Python: Permessage-brotli Inflates A Whole Frame Before MaxMessagePayloadSize Is Checked (incomplete Fix Of GHS

Summary permessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit brotli expands about 1,000,000:1. Any unauthenticated client can exhaust server memory this way on servers that...