CVE-2026-77528

MediumCVSS 5.3/10Last modified Sep 24, 2026

Description

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-409CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-77536.5The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check onCVE-2026-775328.8A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwiCVE-2026-775339.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtCVE-2026-775349.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviCVE-2026-775359.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi NetCVE-2026-775369.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviCVE-2026-7753710.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to CVE-2026-775388.2A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to esCVE-2026-775399.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-77546.5IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration anCVE-2026-775409.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-775419.1A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Netwo
CVE-2026-77528: Medium severity, CVSS 5.3 | Vulnix