CVE-2026-77528

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77528
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77528.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77528
Aliases
  • GHSA-hxp9-w8x3-p566
Downstream
Published
2026-09-18T19:42:18Z
Modified
2026-09-20T11:47:26Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Details

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-409",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77528.json"
}
References

Affected packages

Git / github.com/crossbario/autobahn-python

Affected ranges

Type
GIT
Repo
https://github.com/crossbario/autobahn-python
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
77d323a30b09b1828ad8be2ce6344e056970e613
Fixed
22055b5a3b0e92307e348010260d775dec05be8c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.7.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

19.*
19.3.3
Other
fork-047f5821-oberstet_autobahn_python-fix_1764-202511200000
fork-0685103f-oberstet_autobahn_python-fix_1764-202511132221
fork-07694ec9-oberstet_autobahn_python-fix_1908-202607141156
fork-08262228-oberstet_autobahn_python-fix_1760-202511111707
fork-0ecde788-oberstet_autobahn_python-fix_1771_complete-202511240810
fork-0edf53d3-oberstet_autobahn_python-modernization_phase_1_1-202511251452
fork-0f506ae4-oberstet_autobahn_python-rel_v25_10_1_part1-202510160939
fork-11332fbb-oberstet_autobahn_python-fix_1764-202511172142
fork-12305151-oberstet_autobahn_python-rel_v25_10_2-202510202247
fork-1961e25d-oberstet_autobahn_python-fix_1764-202511171648
fork-336ed2fc-bblommers_autobahn_python-websocket_server_typing-202601090018
fork-388b60f4-oberstet_autobahn_python-rel_v25_9_1_part5c-202510142027
fork-3a671563-oberstet_autobahn_python-fix_1757-202511102019
fork-3af8cd9e-oberstet_autobahn_python-fix_1757-202511102055
fork-3b5ec0b2-oberstet_autobahn_python-fix_1850-202606170939
fork-3b89d6f6-oberstet_autobahn_python-modernization_phase_1_1-202511251607
fork-3ec72f9a-oberstet_autobahn_python-modernization_phase_1_3-202512032120
fork-402c2509-oberstet_autobahn_python-fix_1891-202607011603
fork-46bb48f1-oberstet_autobahn_python-modernization_phase_1_2-202511260912
fork-48d16019-oberstet_autobahn_python-fix_1764-202511130000
fork-4e490deb-oberstet_autobahn_python-sync_autobahn_zlmdb-202512132101
fork-5550a0c3-oberstet_autobahn_python-rel_v25_10_1_part1-202510162022
fork-563b7509-oberstet_autobahn_python-modernization_phase_1_2-202511260144
fork-59ec5a2a-oberstet_autobahn_python-modernization_phase_1_4-202512090529
fork-5a9fad09-oberstet_autobahn_python-fix_1878-202606191302
fork-5c023b9c-oberstet_autobahn_python-fix_1760-202511111319
fork-5fed10a3-oberstet_autobahn_python-rel_v25_10_1_part1-202510162052
fork-62ed99c3-oberstet_autobahn_python-fix_1910-202607142014
fork-65566044-oberstet_autobahn_python-fix_1909-202607141831
fork-68427734-oberstet_autobahn_python-strict_typing_test-202601141357
fork-6b8dd1d8-oberstet_autobahn_python-fix_1771-202511240252
fork-6fb87ff8-oberstet_autobahn_python-rel25_12_1-202512050109
fork-725dbb0e-oberstet_autobahn_python-fix_1877-202607021131
fork-72913a4b-oberstet_autobahn_python-rel_v25_9_1_part5c-202510151335
fork-76cd10f3-oberstet_autobahn_python-rel_v25_10_1_part1-202510152023
fork-783a1c67-oberstet_autobahn_python-fix_1830-202606171555
fork-7970856c-oberstet_autobahn_python-fix_1764-202511142209
fork-7ce4f0c4-oberstet_autobahn_python-sync_autobahn_zlmdb-202512132337
fork-8aa7597f-oberstet_autobahn_python-modernization_phase_1_2-202511270116
fork-8dc09597-oberstet_autobahn_python-fix_1764-202511150024
fork-914bd9b2-oberstet_autobahn_python-fix_1831-202606171139
fork-9191a642-oberstet_autobahn_python-rel_v25_10_1_part1-202510161444
fork-95458ae8-oberstet_autobahn_python-rel_v25_9_1_part5c-202510151212
fork-95d12097-oberstet_autobahn_python-rel25_12_1-202512050325
fork-9802eefc-oberstet_autobahn_python-fix_1911-202607150923
fork-9811e7ed-oberstet_autobahn_python-fix_1875-202607012209
fork-99653ffe-oberstet_autobahn_python-fix_1764-202511202336
fork-9aa0bd54-oberstet_autobahn_python-rel_v25_10_1_part1-202510162031
fork-a1ab19e6-oberstet_autobahn_python-modernization_phase_1_2-202511252215
fork-a52fc8dc-oberstet_autobahn_python-modernization_phase_1_4-202512051755
fork-a6901e83-oberstet_autobahn_python-rel_v25_9_1_part5b-202510132229
fork-a92b17a0-oberstet_autobahn_python-rel_v25_10_1_part1-202510171227
fork-a948beaa-oberstet_autobahn_python-fix_1848-202606170741
fork-ae666ac5-oberstet_autobahn_python-fix_1877-202607021413
fork-b3706c84-oberstet_autobahn_python-fix_1771-202511222354
fork-b9d85017-oberstet_autobahn_python-fix_1764-202511172306
fork-bc964141-oberstet_autobahn_python-fix_1840-202607011813
fork-bf11bedf-oberstet_autobahn_python-fix_1764-202511171908
fork-c49eef15-oberstet_autobahn_python-fix_1764-202511172337
fork-c5313953-oberstet_autobahn_python-rel_v25_10_1_part1-202510161046
fork-c6c0917f-oberstet_autobahn_python-fix_1764-202511202102
fork-c6c33541-oberstet_autobahn_python-fix_1760-202511111620
fork-c6f15fe8-oberstet_autobahn_python-fix_1859-202606161345
fork-ca7875f5-oberstet_autobahn_python-fix_1760-202511111137
fork-cd154a01-oberstet_autobahn_python-fix_1909-202607141552
fork-cee77a0c-bblommers_autobahn_python-chore_apply_ruff_up-202601092138
fork-d1242642-oberstet_autobahn_python-fix_1760-202511111451
fork-d47799a9-oberstet_autobahn_python-rel_v25_9_1_part5b-202510141842
fork-d5809869-oberstet_autobahn_python-modernization_phase_1_3-202512022045
fork-db8dd82d-oberstet_autobahn_python-rel_v25_9_1_part5c-202510150241
fork-dde8d1e8-oberstet_autobahn_python-fix_1764-202511140104
fork-de4c5238-oberstet_autobahn_python-rel_v25_10_2_part2-202510222023
fork-de4c5238-oberstet_autobahn_python-rel_v25_10_2_part2-202510222024
fork-e20b27c3-oberstet_autobahn_python-fix_1767-202511210942
fork-e431e88e-oberstet_autobahn_python-rel_v25_10_2-202510210040
fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609
fork-f8a785d9-oberstet_autobahn_python-rel_v25_9_1_part5b-202510141950
fork-fba06933-oberstet_autobahn_python-fix_1764-202511141246
fork-fe7f7843-oberstet_autobahn_python-fix_1909-202607141627
fork_07694ec9_oberstet_autobahn_python_fix_1908_202607141156
fork_0ecde788_oberstet_autobahn_python_fix_1771_complete_202511240810
fork_3b5ec0b2_oberstet_autobahn_python_fix_1850_202606170939
fork_62ed99c3_oberstet_autobahn_python_fix_1910_202607142014
fork_9802eefc_oberstet_autobahn_python_fix_1911_202607150923
fork_9811e7ed_oberstet_autobahn_python_fix_1875_202607012209
fork_bc964141_oberstet_autobahn_python_fix_1840_202607011813
master-202510102120
master-202510110102
master-202510110103
master-202510111121
master-202510111122
master-202510111145
master-202510111146
master-202510111201
master-202510111202
master-202510111215
master-202510111216
master-202510111248
master-202510111405
master-202510111432
master-202510111643
master-202510111957
master-202510111958
master-202510130730
master-202510130731
master-202510142011
master-202510150228
master-202510150311
master-202510151146
master-202510151247
master-202510180103
master-202510180801
master-202510181550
master-202510181644
master-202510182244
master-202510191601
master-202510200138
master-202510201326
master-202510221133
master-202510221134
master-202510221810
master-202510221912
master-202510222108
master-202510222109
master-202511081227
master-202511081228
master-202511081609
master-202511102153
master-202511111723
master-202511111724
master-202511210011
master-202511210957
master-202511210958
master-202511240707
master-202511240823
master-202511251629
master-202512040348
master-202512050044
master-202512051009
master-202512051011
master-202512090545
master-202512092130
master-202512092131
master-202512100151
master-202512111100
master-202512111101
master-202512111629
master-202512111854
master-202512111855
master-202512150317
master-202512150825
master-202601091234
master-202601101042
master-202606162003
master-202606170853
master-202606171850
master-202606251624
master-202607011745
master-202607021552
master_202510102120
master_202510111957
master_202510130730
pr1698-null-rel_v25_9_1_part5c-202510142013
v25_10_1
v25_10_2
v25_12_1
v25_12_2
v25_9_1
v26_6_1
v26_6_2
wheels-20250920-7dbac37c
wheels-20250920-ec9e4274
wheels-20250928-dbf5d6feae43b99a2620848dc70f5a2ef4cd2aa7
wheels-20251004-12c36f1968f26c4834f7a6b6d6bab1c5a36fcd47
wheels-20251007-4691a2b044bd3de73ae03aa20a0240ee4a127c66
wheels-20251007-980727a0246ca77c187b83811572b567b3bb6e3c
wheels-docker-20250920-7dbac37c
wheels-docker-20250928-dbf5d6fe
wheels-docker-20251004-12c36f19
wheels-docker-20251007-4691a2b0
wheels-docker-20251007-980727a0
v0.*
v0.1
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.5-2
v0.10.6
v0.10.7
v0.10.8
v0.10.9
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.14.0
v0.14.1
v0.15.0
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.18.2
v0.2
v0.3
v0.3.1
v0.4.0
v0.4.1
v0.4.10
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.3
v0.6.4
v0.6.5
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.8.10
v0.8.12-2
v0.8.13
v0.8.14
v0.8.15
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.8
v0.8.9
v0.9.0
v0.9.2
v0.9.3
v0.9.3-2
v0.9.3-3
v0.9.4
v0.9.4-2
v0.9.5
v0.9.6
v17.*
v17.10.1
v17.5.1
v17.6.1
v17.7.1
v17.8.1
v17.9.1
v17.9.2
v17.9.3
v18.*
v18.11.1
v18.11.2
v18.12.1
v18.3.1
v18.5.1
v18.5.2
v19.*
v19.1.1
v19.10.1
v19.11.1
v19.2.1
v19.3.1
v19.3.2
v19.5.1
v19.6.1
v19.6.2
v19.7.1
v19.8.1
v19.9.1
v19.9.2
v19.9.3
v20.*
v20.1.1
v20.1.2
v20.1.3
v20.12.1
v20.12.2
v20.12.3
v20.2.1
v20.2.2
v20.3.1
v20.4.1
v20.4.2
v20.4.3
v20.6.1
v20.6.2
v20.7.1
v21.*
v21.1.1
v21.11.1
v21.2.1
v21.2.2
v21.3.1
v22.*
v22.1.1
v22.12.1
v22.2.1
v22.2.2
v22.3.1
v22.3.2
v22.4.1
v22.4.2
v22.5.1
v22.6.1
v22.7.1
v23.*
v23.1.1
v23.1.2
v23.6.1
v23.6.2
v24.*
v24.4.2
v25.*
v25.10.1
v25.10.2
v25.12.1
v25.12.2
v25.9.1
v26.*
v26.6.1
v26.6.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77528.json"