# CVE-2026-77528: Autobahn Python permessage-deflate decompression bypass in maxMessagePayloadSize

Source: https://junglewise.ai/threats/cve-2026-77528-autobahn-python-permessage-deflate-decompression-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77528 · Severity: medium · CVSS 5.3 · Published 2026-09-18

Autobahn Python is a WebSocket library used to build real-time web applications. The library enforces message size limits on compressed WebSocket frames but fails to re-check the limit after decompression, allowing an attacker to send small compressed messages that expand to large sizes after inflation and bypass the resource boundary protection.

Technologies: [autobahn (PyPI)](https://junglewise.ai/threats/technologies/autobahn). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-77528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77528 being exploited in the wild.

**How severe is CVE-2026-77528?** Medium severity, with a CVSS score of 5.3, published 18 September 2026.

**Which products and versions are affected?** Autobahn Python unknown; autobahn (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1; crossbar (PyPI) < 26.7.1, ECOSYSTEM:introduced=0,fixed=26.7.1.

**Is there a fix for CVE-2026-77528?** Yes. autobahn (PyPI): upgrade to 26.7.1 or later; crossbar (PyPI): upgrade to 26.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77528 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77528?** Check whether you run Autobahn Python, autobahn (PyPI) or crossbar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- autobahn (PyPI): upgrade to 26.7.1 or later

  ```sh
  pip install "autobahn>=26.7.1"
  ```

- crossbar (PyPI): upgrade to 26.7.1 or later

  ```sh
  pip install "crossbar>=26.7.1"
  ```


## Technical details

This is a message size validation bypass vulnerability affecting the permessage-deflate compression extension in Autobahn Python. The root cause is a structural flaw in compression handling: `maxMessagePayloadSize` is enforced against the pre-inflation compressed frame length, but the decompressed payload is delivered to application callbacks without a second size check. The vulnerability occurs because the `PerMessageDeflate` compressor object is initialized with `max_message_size=None` by default, disabling per-decompressor enforcement. An unauthenticated remote client can exploit this by sending a masked compressed WebSocket text frame with RSV1 set and compressed length below the configured limit; after inflation, the message may far exceed the limit (e.g., 22 bytes compressed → 4096 bytes decompressed against a 128-byte limit). The attack requires the server to accept permessage-deflate offers and apply a `maxMessagePayloadSize` configuration. A fix is available and involves re-checking the inflated message size against the limit after decompression.

## Affected products

- Autobahn Autobahn Python unknown

## Identifiers

- CVE-2026-77528
- GHSA-hxp9-w8x3-p566
- PYSEC-2026-4027
- PYSEC-2026-4031

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: advisory: GHSA-hxp9-w8x3-p566

## Related threats

- [Autobahn Python memory exhaustion in Brotli decompression](https://junglewise.ai/threats/cve-2026-116579-autobahn-python-is-a-websocket-and-wamp-implementation-for)
- [Timing attack](https://junglewise.ai/threats/timing-attack-b1717e88)
- [PYSEC-2020-25 - Autobahn|Python before 20.12.3 allows redirect header injection.](https://junglewise.ai/threats/cve-2020-35678-open-redirect-in-autobahn)