Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the remaining output budget and are outside this residual vulnerability. This issue is fixed in version 26.10.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From
    26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli
    decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been
    inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates
    hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the
    opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the
    remaining output budget and are outside this residual vulnerability. This issue is fixed in version
    26.10.1. (CVE-2026-116579)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From     26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli     decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been     inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates     hundreds of MiB before rejection, causing memory-exhaustion denial of service on servers that enable the     opt-in permessage-brotli feature through the compress extra. Deflate and bzip2 already enforce the     remaining output budget and are outside this residual vulnerability. This issue is fixed in version     26.10.1. (CVE-2026-116579)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478018	Chainguard: awx: security update to 24.6.1-r76	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478018	Chainguard: awx: security update to 24.6.1-r76	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
477775	SCA: security update for autobahn (GHSA-pjh6-c8mg-3x7m)	Tenable Cloud Security	SCA Checks	Local	medium
477775	SCA: security update for autobahn (GHSA-pjh6-c8mg-3x7m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
373399	Linux Distros Unpatched Vulnerability : CVE-2026-116579	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-116579

medium

Tenable Plugins

medium

medium

medium

medium

medium