{"action":"Upgrade crossbar to 26.7.1 or later.","affected":[{"fixed":"26.7.1","introduced":"0"}],"component":"crossbar","cve_ids":["CVE-2026-77528"],"ecosystem":"PyPI","epss":0.00524,"exploited":false,"fixed_versions":["26.7.1"],"ghsa_id":"GHSA-hxp9-w8x3-p566","id":"tcs_01M5KFMRF5DSV04TA9BJF8AR2P","modified_at":"2026-10-01T17:55:38.804385392Z","published_at":"2026-09-22T20:37:28Z","references":["https://osv.dev/vulnerability/GHSA-hxp9-w8x3-p566","https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566","https://nvd.nist.gov/vuln/detail/CVE-2026-77528","https://github.com/crossbario/autobahn-python/pull/1916","https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613","https://github.com/crossbario/autobahn-python","https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-hxp9-w8x3-p566#PyPI/crossbar","url":"https://osv.dev/vulnerability/GHSA-hxp9-w8x3-p566"}],"summary":"Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation"}