# CVE-2026-116579: Autobahn Python memory exhaustion in Brotli decompression

Source: https://junglewise.ai/threats/cve-2026-116579-autobahn-python-is-a-websocket-and-wamp-implementation-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116579 · Severity: medium · CVSS 5.9 · Published 2026-10-26

Autobahn Python is a WebSocket and WAMP messaging framework for Python. When the optional permessage-brotli compression feature is enabled, an unauthenticated attacker can send a small compressed WebSocket frame that allocates hundreds of megabytes of memory before being rejected, causing denial of service by exhausting server memory.

Technologies: [autobahn (PyPI)](https://junglewise.ai/threats/technologies/autobahn). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116579 being exploited in the wild.

**How severe is CVE-2026-116579?** Medium severity, with a CVSS score of 5.9, published 26 October 2026.

**Which products and versions are affected?** Crossbar Autobahn Python 26.7.1 to 26.10.0; autobahn (PyPI) >= 26.7.1, < 26.10.1, ECOSYSTEM:introduced=26.7.1,fixed=26.10.1.

**Is there a fix for CVE-2026-116579?** Yes. autobahn (PyPI): upgrade to 26.10.1 or later. Until then: Disable the permessage-brotli compression extension unless specifically required, or restrict WebSocket connections to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116579 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116579?** Check whether you run Crossbar Autobahn Python or autobahn (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- autobahn (PyPI): upgrade to 26.10.1 or later

  ```sh
  pip install "autobahn>=26.10.1"
  ```


Disable the permessage-brotli compression extension unless specifically required, or restrict WebSocket connections to trusted clients only.

## Technical details

The vulnerability is a resource exhaustion flaw in PerMessageBrotli.decompress_message_data() in compress_brotli.py. The Brotli decompressor is called without an output size limit, and the maxMessagePayloadSize check occurs only after the entire frame has been inflated in memory. An unauthenticated WebSocket client can exploit this by sending a highly compressed payload that decompresses to a massive size, triggering memory exhaustion before the size check rejects it. The attack requires the opt-in permessage-brotli feature to be enabled.

## Affected products

- Crossbar Autobahn Python 26.7.1 to 26.10.0

## Identifiers

- CVE-2026-116579
- GHSA-pjh6-c8mg-3x7m

## Timeline

- 2026-10-26: disclosed
- 2026-10-17: patched: Fix commit merged; released in 26.10.1

## References

- [https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1](https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1)
- [https://github.com/crossbario/autobahn-python/pull/1987](https://github.com/crossbario/autobahn-python/pull/1987)

## Related threats

- [Autobahn Python permessage-deflate decompression bypass in maxMessagePayloadSize](https://junglewise.ai/threats/cve-2026-77528-autobahn-python-permessage-deflate-decompression-bypass-in)
- [Timing attack](https://junglewise.ai/threats/timing-attack-b1717e88)
- [PYSEC-2020-25 - Autobahn|Python before 20.12.3 allows redirect header injection.](https://junglewise.ai/threats/cve-2020-35678-open-redirect-in-autobahn)