Autobahn Python
Monthly
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.