What is CVE-2026-116579?

CVE-2026-116579 is a medium-severity vulnerability in Crossbario Autobahn-Python, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.9/10. Published 2026-10-26.

How severe is CVE-2026-116579?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Resource exhaustion in Crossbario Autobahn-Python

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

Published 2026-10-26.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Crossbario Autobahn-Python — versions >= 26.7.1, < 26.10.1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-116579?: CVE-2026-116579 is a medium-severity vulnerability in Crossbario Autobahn-Python, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.9/10. Published 2026-10-26.
How severe is CVE-2026-116579?: Medium severity. CVSS v3 base score is 5.9 out of 10.