Is CVE-2026-77528 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77528 being exploited in the wild.

How severe is CVE-2026-77528?

Medium severity, with a CVSS score of 5.3, published 18 September 2026.

Which products and versions are affected?

Autobahn Python unknown; autobahn (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1; crossbar (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1.

Is there a fix for CVE-2026-77528?

Yes. autobahn (PyPI): upgrade to 26.7.1 or later; crossbar (PyPI): upgrade to 26.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77528 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77528?

Check whether you run Autobahn Python, autobahn (PyPI) or crossbar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77528: Autobahn Python permessage-deflate decompression bypass in maxMessagePayloadSize

Q: Is there a fix for CVE-2026-77528?

Yes. autobahn (PyPI): upgrade to 26.7.1 or later; crossbar (PyPI): upgrade to 26.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77528 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77528?

Check whether you run Autobahn Python, autobahn (PyPI) or crossbar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77528 · Severity: medium · CVSS 5.3 · Published 2026-09-18

Autobahn Python is a WebSocket library used to build real-time web applications. The library enforces message size limits on compressed WebSocket frames but fails to re-check the limit after decompression, allowing an attacker to send small compressed messages that expand to large sizes after inflation and bypass the resource boundary protection.

Technologies: autobahn (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77528 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77528 being exploited in the wild.
How severe is CVE-2026-77528?: Medium severity, with a CVSS score of 5.3, published 18 September 2026.
Which products and versions are affected?: Autobahn Python unknown; autobahn (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1; crossbar (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1.
Is there a fix for CVE-2026-77528?: Yes. autobahn (PyPI): upgrade to 26.7.1 or later; crossbar (PyPI): upgrade to 26.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77528 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77528?: Check whether you run Autobahn Python, autobahn (PyPI) or crossbar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

autobahn (PyPI): upgrade to 26.7.1 or later
```
pip install "autobahn>=26.7.1"
```
crossbar (PyPI): upgrade to 26.7.1 or later
```
pip install "crossbar>=26.7.1"
```

Technical details

This is a message size validation bypass vulnerability affecting the permessage-deflate compression extension in Autobahn Python. The root cause is a structural flaw in compression handling: `maxMessagePayloadSize` is enforced against the pre-inflation compressed frame length, but the decompressed payload is delivered to application callbacks without a second size check. The vulnerability occurs because the `PerMessageDeflate` compressor object is initialized with `max_message_size=None` by default, disabling per-decompressor enforcement. An unauthenticated remote client can exploit this by sending a masked compressed WebSocket text frame with RSV1 set and compressed length below the configured limit; after inflation, the message may far exceed the limit (e.g., 22 bytes compressed → 4096 bytes decompressed against a 128-byte limit). The attack requires the server to accept permessage-deflate offers and apply a `maxMessagePayloadSize` configuration. A fix is available and involves re-checking the inflated message size against the limit after decompression.

Affected products

Autobahn Autobahn Python unknown

Identifiers

CVE-2026-77528
GHSA-hxp9-w8x3-p566
PYSEC-2026-4027
PYSEC-2026-4031

Timeline

2026-09-22: disclosed
2026-09-22: advisory: GHSA-hxp9-w8x3-p566

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.