Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

crossbar

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PyPIAmendedPublished

    Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

    CVE-2026-77528 · GHSA-hxp9-w8x3-p566

    Affected
    • PyPI crossbar < 26.7.1
    Fixed in
    26.7.1· Vendor fix available
    Issue
    Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 bytes and reach onMessage even when the application configured a 128-byte message limit, defeating the resource boundary the option is meant to provide. Details The permessage-deflate path installs a PerMessageDeflate instance when the server accepts a client offer in src/autobahn/websocket/protocol.py:3371. The common PerMessageDeflateOfferAccept(offer) path leaves maxmessagesize at its default None in src/autobahn/websocket/compressdeflate.py:295, and that value is copied into the compressor object in src/autobahn/websocket/compressdeflate.py:723. When a data frame arrives with RSV1 set, Autobahn marks the message compressed in src/autobahn/websocket/protocol.py:1812, calls…

    Recommended action: Upgrade to 26.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →