Autobahn Python CVE-2026-116579

The server must have explicitly enabled the opt-in permessage-brotli compression extension (installed via the 'compress' extra) and negotiated it with the connecting client; only Autobahn Python 26.7.1 through <26.10.1 is affected. No authentication or user interaction is required (CVSS PR:N/UI:N), so any reachable unauthenticated WebSocket client can trigger it against a default configuration of a brotli-enabled server. Limiting factors that reduce realistic risk: permessage-brotli is NOT a default - it must be deliberately enabled - and the permessage-deflate, -bzip2 and -snappy extensions already enforce the remaining output budget and are not affected; impact is availability only, with no confidentiality or integrity exposure.

Signals point to a genuine but bounded risk. The vendor-confirmed GHSA advisory (GHSA-pjh6-c8mg-3x7m) describes an unauthenticated memory-exhaustion DoS with CVSS:3.1/AV:N/PR:N/UI:N and A:H - network-reachable, no privileges, availability-only impact (C:N/I:N). A full, tested proof-of-concept is published in the advisory (one 421-byte frame peaks the server at 545 MiB), so triggering is trivial once the feature is reachable; this is not a theoretical bug. However, the real-world attack surface is gated by a non-default precondition: the server must have opted into permessage-brotli via the 'compress' extra, which the advisory stresses is opt-in. This explains the modest signals elsewhere - EPSS is low (0.43%, 37th percentile), the vuln is NOT in CISA KEV (no confirmed active exploitation), and the vendor priority label is 'this_month' rather than emergency. One notable tension: NVD rates AC:H, yet the published PoC shows a single small frame triggers the condition with no race, timing or attacker-uncontrolled element described - the 'complexity' is really the non-default configuration dependency, not attack difficulty. Net: a real priority for the subset of deployments that enabled permessage-brotli, lower urgency for everyone else, with no confidentiality or integrity exposure.

An attacker connects to a public Autobahn Python WebSocket server that has enabled the opt-in permessage-brotli compression extension and sends a tiny (~421-byte) highly compressed brotli frame. The server's PerMessageBrotli.decompress_message_data inflates the entire frame before checking maxMessagePayloadSize, allocating hundreds of MiB per frame; a few concurrent connections exhaust server memory and cause denial of service. A working, reporter-tested proof-of-concept is published in the GHSA advisory.