CVE-2026-116579

Name of the Vulnerable Software and Affected Versions Autobahn Python versions 26.7.1 through 26.10.0

Description An unauthenticated WebSocket client can trigger a memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature. This occurs because the decompress message data() function in compress brotli.py calls the Brotli decompressor without an output limit and only verifies the maxMessagePayloadSize variable after a complete frame has been inflated. Consequently, a small, highly compressed frame can allocate hundreds of MiB of memory before being rejected.

Recommendations Update to version 26.10.1. Restrict the use of the permessage-brotli feature to minimize the risk of exploitation.