MediumVulnerabilityCVE-2026-116579updated 28 Oct 2026, 21:10 UTC

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of…

Fixed in autobahn 26.10.1Official source

Severity	MediumCVSS 5.9 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesautobahn 26.10.1 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
autobahn · pip	>= 26.7.1, < 26.10.1	26.10.1

Timeline

28 Oct 2026, 21:10 UTC
Publicly disclosed
28 Oct 2026, 21:10 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:10 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)GitHub Advisory · 28 Oct 2026, 21:10 UTC

Technical details

ID: CVE-2026-116579 · GHSA-pjh6-c8mg-3x7m
CVSS: 5.9 / 10
EPSS: 0.4% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 21:10 UTC
On Zero Radar: 28 Oct 2026, 21:10 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 21:10 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of… · Zero Radar