Homepage

Improper Handling of Highly Compressed Data (Data Amplification) Affecting python-autobahn package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.4% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-PYTHONAUTOBAHN-19946236
  • published19 Sept 2026
  • disclosed18 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 18 Sep 2026

NewCVE-2026-77528  (opens in a new tab)
CWE-409  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

There is no fixed version for Echo:latest python-autobahn.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-autobahn package and not the python-autobahn package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.