---
id: CVE-2026-77528
title: >-
  Autobahn Python is a WebSocket and WAMP implementation for Python that
  supports Twisted and asyncio
summary: >-
  Autobahn Python is a WebSocket and WAMP implementation for Python that
  supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept
  permessage-deflate and rely on maxMessagePayloadSize enforce that limit
  against the com…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-409
  - CWE-770
vendor: crossbario
product: autobahn-python
affected:
  - autobahn-python < 26.7.1
patched:
  - autobahn 26.7.1
  - crossbar 26.7.1
published: '2026-09-18'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77528'
references:
  - url: >-
      https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613
    label: security-advisories@github.com
  - url: 'https://github.com/crossbario/autobahn-python/pull/1916'
    label: security-advisories@github.com
  - url: 'https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77528'
  - url: 'https://github.com/advisories/GHSA-hxp9-w8x3-p566'
  - url: 'https://github.com/crossbario/autobahn-python'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
  - osv
epss: 0.00524
epssPercentile: 0.41908
aliases:
  - GHSA-hxp9-w8x3-p566
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-19T13:37:22.821549Z'
ingestedAt: '2026-09-18T19:49:30.586Z'
---

## Overview

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-77528)

Affected packages:

- `autobahn < 26.7.1`
- `crossbar < 26.7.1`

Patched in:

- `autobahn 26.7.1`
- `crossbar 26.7.1`

Source: https://github.com/advisories/GHSA-hxp9-w8x3-p566