Executive brief
Autobahn Python is a WebSocket library used to build real-time web applications. The library enforces message size limits on compressed WebSocket frames but fails to re-check the limit after decompression, allowing an attacker to send small compressed messages that expand to large sizes after inflation and bypass the resource boundary protection.
Technical details
This is a message size validation bypass vulnerability affecting the permessage-deflate compression extension in Autobahn Python. The root cause is a structural flaw in compression handling: `maxMessagePayloadSize` is enforced against the pre-inflation compressed frame length, but the decompressed payload is delivered to application callbacks without a second size check. The vulnerability occurs because the `PerMessageDeflate` compressor object is initialized with `max_message_size=None` by default, disabling per-decompressor enforcement. An unauthenticated remote client can exploit this by sending a masked compressed WebSocket text frame with RSV1 set and compressed length below the configured limit; after inflation, the message may far exceed the limit (e.g., 22 bytes compressed → 4096 bytes decompressed against a 128-byte limit). The attack requires the server to accept permessage-deflate offers and apply a `maxMessagePayloadSize` configuration. A fix is available and involves re-checking the inflated message size against the limit after decompression.
Affected products
- Autobahn Autobahn Python unknown
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory: GHSA-hxp9-w8x3-p566