CVE catalog

CVE-2026-77528

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Sep 18, 2026, 8:17:22 PM UTC
Updated: Sep 18, 2026, 8:17:22 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.52% · Oct 25, 2026

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-autobahn	sid	`24.4.2+dfsg1-5`	vulnerable
Debian	python-autobahn	forky	`24.4.2+dfsg1-5`	vulnerable
Debian	python-autobahn	trixie	`23.1.2+dfsg1-2`	vulnerable
Debian	python-autobahn	bookworm	`22.7.1+dfsg1-2`	vulnerable
Pip	autobahn	Not reported	`26.7.1`	fixed
Pip	crossbar	Not reported	`26.7.1`	fixed
Opensuse	python-autobahn	tumbleweed	`26.7.1-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-autobahn	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	python-autobahn	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	python-autobahn	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	python-autobahn	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Pip	autobahn	pip	Not reported	`26.7.1`	Not reported	GHSA-HXP9-W8X3-P566	Not reported
Pip	crossbar	pip	Not reported	`26.7.1`	Not reported	GHSA-HXP9-W8X3-P566	Not reported
Opensuse	python-autobahn	rpm	tumbleweed	`26.7.1-2.1`	Not reported	OPENSUSE-SU-2026:11852-1	Not reported

Notes

[trixie] python-autobahn: Minor issue [bookworm] python-autobahn: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-autobahn]Affected
Source package: [python-autobahn]
Details (2)
- 22.7.1+dfsg1-2 · all · bookworm
  Affected
  nvd · python-autobahn · debian · bookworm; nvd · python-autobahn · debian · 12
- 22.7.1+dfsg1-2 · all · bookworm
  Affected
  nvd · python-autobahn · debian · bookworm; nvd · python-autobahn · debian · 12

[Debian 13 (Trixie)]

[python3-autobahn]Affected
Source package: [python-autobahn]
Details (2)
- 23.1.2+dfsg1-2 · all · trixie
  Affected
  nvd · python-autobahn · debian · 13
- 23.1.2+dfsg1-2 · all · trixie
  Affected
  nvd · python-autobahn · debian · 13

[openSUSE Tumbleweed]

[python313-autobahn]Unknown
Source package: [python-autobahn]
Details (1)
- 24.4.2-2.6 · x86_64 · tumbleweed
  Unknown · Fixed: 26.7.1-2.1
  Version impact unknown
  nvd · python-autobahn · opensuse · tumbleweed
[python314-autobahn]Unknown
Source package: [python-autobahn]
Details (1)
- 24.4.2-2.6 · x86_64 · tumbleweed
  Unknown · Fixed: 26.7.1-2.1
  Version impact unknown
  nvd · python-autobahn · opensuse · tumbleweed

Observed: Oct 23, 2026, 8:36:53 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]