CVE-2026-77528

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification). Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613
• https://github.com/crossbario/autobahn-python/pull/1916
• https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1
• https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566