Is CVE-2026-116579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116579 being exploited in the wild.

How severe is CVE-2026-116579?

Medium severity, with a CVSS score of 5.9, published 26 October 2026.

Which products and versions are affected?

Crossbar Autobahn Python 26.7.1 to 26.10.0; autobahn (PyPI) >= 26.7.1, < 26.10.1, ECOSYSTEM:introduced=26.7.1,fixed=26.10.1.

How is CVE-2026-116579 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116579?

Check whether you run Crossbar Autobahn Python or autobahn (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116579: Autobahn Python memory exhaustion in Brotli decompression

Q: Is there a fix for CVE-2026-116579?

Yes. autobahn (PyPI): upgrade to 26.10.1 or later. Until then: Disable the permessage-brotli compression extension unless specifically required, or restrict WebSocket connections to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116579 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116579?

Check whether you run Crossbar Autobahn Python or autobahn (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116579 · Severity: medium · CVSS 5.9 · Published 2026-10-26

Autobahn Python is a WebSocket and WAMP messaging framework for Python. When the optional permessage-brotli compression feature is enabled, an unauthenticated attacker can send a small compressed WebSocket frame that allocates hundreds of megabytes of memory before being rejected, causing denial of service by exhausting server memory.

Technologies: autobahn (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-116579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116579 being exploited in the wild.
How severe is CVE-2026-116579?: Medium severity, with a CVSS score of 5.9, published 26 October 2026.
Which products and versions are affected?: Crossbar Autobahn Python 26.7.1 to 26.10.0; autobahn (PyPI) >= 26.7.1, < 26.10.1, ECOSYSTEM:introduced=26.7.1,fixed=26.10.1.
Is there a fix for CVE-2026-116579?: Yes. autobahn (PyPI): upgrade to 26.10.1 or later. Until then: Disable the permessage-brotli compression extension unless specifically required, or restrict WebSocket connections to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116579 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116579?: Check whether you run Crossbar Autobahn Python or autobahn (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

autobahn (PyPI): upgrade to 26.10.1 or later
```
pip install "autobahn>=26.10.1"
```

Disable the permessage-brotli compression extension unless specifically required, or restrict WebSocket connections to trusted clients only.

Technical details

The vulnerability is a resource exhaustion flaw in PerMessageBrotli.decompress_message_data() in compress_brotli.py. The Brotli decompressor is called without an output size limit, and the maxMessagePayloadSize check occurs only after the entire frame has been inflated in memory. An unauthenticated WebSocket client can exploit this by sending a highly compressed payload that decompresses to a massive size, triggering memory exhaustion before the size check rejects it. The attack requires the opt-in permessage-brotli feature to be enabled.

Affected products

Crossbar Autobahn Python 26.7.1 to 26.10.0

Identifiers

CVE-2026-116579
GHSA-pjh6-c8mg-3x7m

Timeline

2026-10-26: disclosed
2026-10-17: patched: Fix commit merged; released in 26.10.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.