CVE-2026-116579: 
Python vulnerability analysis and mitigation

CVE-2026-116579 is a memory-exhaustion denial-of-service vulnerability in Autobahn Python, a WebSocket and WAMP implementation for Python supporting Twisted and asyncio. The flaw exists in PerMessageBrotli.decompress_message_data within compress_brotli.py, which inflates an entire Brotli-compressed WebSocket frame before checking the configured maxMessagePayloadSize limit. This allows an unauthenticated remote client to send a tiny, highly compressed frame (e.g., 421 bytes expanding to ~545 MiB) and exhaust server memory. Affected versions are autobahn (pip) >= 26.7.1 and < 26.10.1; the issue is fixed in version 26.10.1. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification) and CWE-770 (Allocation of Resources Without Limits or Throttling). In the vulnerable code path, PerMessageBrotli.decompress_message_data calls self._decompressor.process(data) with no output_buffer_limit argument, fully inflating the frame before comparing the output length against max_output_len. By contrast, the deflate and bzip2 backends correctly pass the remaining budget as a cap to their respective decompressors, stopping decompression incrementally. Brotli's compression ratio can reach approximately 1,000,000:1 (841 bytes inflating to 1 GiB), making the wire-size bound from maxFramePayloadSize effectively meaningless. This is an incomplete fix of a prior advisory (GHSA-hxp9-w8x3-p566). A public proof-of-concept is included in the GitHub security advisory, demonstrating that a 421-byte frame against a 1 MiB budget peaks at 545 MiB RSS before rejection (GitHub Advisory, Fix Commit).

Successful exploitation causes memory exhaustion on the affected server, resulting in a denial-of-service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. A few concurrent malicious WebSocket connections sending small, maximally compressed Brotli frames can exhaust all available server memory, potentially crashing the process or the host, and disrupting all services running on the affected system. Only servers that have explicitly enabled the opt-in permessage-brotli feature via the compress extra are affected (GitHub Advisory).

A public proof-of-concept is included in the GitHub security advisory, demonstrating the vulnerability with a minimal Python script using the autobahn and brotli libraries. No authentication or special privileges are required; any unauthenticated WebSocket client can trigger the issue against a server with permessage-brotli enabled. The EPSS score is 0.0 as of the time of publication, and there is no evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Identify target: Locate a server running Autobahn Python versions >= 26.7.1 and < 26.10.1 with the permessage-brotli WebSocket extension enabled (requires the compress extra to be installed).
2. Set up environment: Install the required libraries: pip install autobahn==26.7.1 brotli==1.2.0.
3. Craft a compression bomb: Use the Brotli compressor to create a highly compressed payload — for example, compress 256 MiB of zero bytes into a ~421-byte frame:

import brotli
c = brotli.Compressor()
frame = b"".join(c.process(b"\0" * (1 << 20)) for _ in range(256)) + c.finish()

4. Connect and negotiate: Establish a WebSocket connection to the target server and negotiate the permessage-brotli extension during the WebSocket handshake.
5. Send the bomb frame: Transmit the crafted compressed frame as a WebSocket message. The server's PerMessageBrotli.decompress_message_data will fully inflate the frame (allocating ~545 MiB) before checking maxMessagePayloadSize.
6. Repeat for exhaustion: Send multiple concurrent connections with the same payload to exhaust all available server memory, causing a denial-of-service condition (GitHub Advisory).

• Network: Repeated WebSocket connections from the same or multiple source IPs sending very small frames (hundreds of bytes) that trigger large memory allocations; connections that negotiate permessage-brotli extension and immediately send compressed data.
• Process/System: Rapid and sustained increase in the Python server process's RSS memory (potentially hundreds of MiB per connection); OOM killer events in system logs (dmesg, /var/log/syslog) targeting the autobahn server process.
• Logs: Application logs showing PayloadExceededError raised repeatedly from compress_brotli.py; high-frequency WebSocket connection attempts followed by immediate disconnection after a single message.
• Resource Monitoring: Sudden spikes in memory usage on the host correlating with incoming WebSocket traffic, particularly from unauthenticated clients (GitHub Advisory).

Upgrade to autobahn version 26.10.1 or later, which fixes the issue by passing output_buffer_limit=max_output_len + 1 to brotli.Decompressor.process(), stopping decompression near the configured budget rather than after full frame inflation. The fix also raises the minimum required brotli/brotlicffi version to >= 1.2.0, the first release supporting the output_buffer_limit parameter. As a workaround for those unable to upgrade immediately, disable the permessage-brotli extension by not installing the compress extra or by not offering Brotli compression in the server's WebSocket configuration — deflate and bzip2 are unaffected by this specific vulnerability (GitHub Advisory, Release v26.10.1).

The vulnerability was reported by security researcher Adrian Korwel (credited as adriank31 in the GitHub advisory) and published by the Crossbario maintainer (oberstet) on October 19, 2026. The fix was developed with AI assistance (Claude Code) as disclosed in the pull request. No significant broader media coverage or notable community commentary beyond the GitHub advisory and associated pull request has been identified at this time (GitHub Advisory, Fix PR).