CVE-2026-77528Medium· 5.3▾ SunlitAutobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the com…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.5%
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
autobahn < 26.7.1crossbar < 26.7.1Patched in:
autobahn 26.7.1crossbar 26.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-105747Medium· 4.3Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-40036High· 7.5Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service
CVE-2026-40192High· 7.5Pillow is a Python imaging library
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-116579Medium· 5.9Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)