{"record":{"id":"67490cd424b5029d","repo":"aio-libs/aiohttp","slug":"wsclosecode-message-too-big-67490c","errorCode":"WSCloseCode.MESSAGE_TOO_BIG","errorMessage":"Decompressed message exceeds size limit {self._max_msg_size}","messagePattern":"Decompressed message exceeds size limit (.+?)","errorType":"exception","errorClass":"WebSocketError","httpStatus":null,"severity":"error","filePath":"aiohttp/_websocket/reader_c.py","lineNumber":257,"sourceCode":"            # received.\n            if compressed:\n                if not self._decompressobj:\n                    self._decompressobj = ZLibDecompressor(suppress_deflate_header=True)\n                # XXX: It's possible that the zlib backend (isal is known to\n                # do this, maybe others too?) will return max_length bytes,\n                # but internally buffer more data such that the payload is\n                # >max_length, so we return one extra byte and if we're able\n                # to do that, then the message is too big.\n                payload_merged = self._decompressobj.decompress_sync(\n                    assembled_payload + WS_DEFLATE_TRAILING,\n                    (\n                        self._max_msg_size + 1\n                        if self._max_msg_size\n                        else self._max_msg_size\n                    ),\n                )\n                if self._max_msg_size and len(payload_merged) > self._max_msg_size:\n                    raise WebSocketError(\n                        WSCloseCode.MESSAGE_TOO_BIG,\n                        f\"Decompressed message exceeds size limit {self._max_msg_size}\",\n                    )\n            elif type(assembled_payload) is bytes:\n                payload_merged = assembled_payload\n            else:\n                payload_merged = bytes(assembled_payload)\n\n            size = len(payload_merged)\n            if opcode == OP_CODE_TEXT:\n                if self._decode_text:\n                    try:\n                        text = payload_merged.decode(\"utf-8\")\n                    except UnicodeDecodeError as exc:\n                        raise WebSocketError(\n                            WSCloseCode.INVALID_TEXT, \"Invalid UTF-8 text message\"\n                        ) from exc\n","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/d9aaf697c2cd4783ca5749a971965c689f3ec24f/aiohttp/_websocket/reader_c.py#L239-L275","documentation":"Raised after a compressed WebSocket message (permessage-deflate) is fully assembled and decompressed, if the decompressed size exceeds self._max_msg_size. This is the permessage-deflate equivalent of the MESSAGE_TOO_BIG guard: compressed bytes can expand greatly, so aiohttp decompresses with a max_length of max_msg_size+1 and rejects anything larger (reader_c.py:256-260).","triggerScenarios":"A remote peer negotiates permessage-deflate and sends a highly compressible payload (e.g. repetitive data) that is small on the wire but decompresses beyond max_msg_size (default 4 MB on client via ws_connect, 4 MB on server via WebSocketResponse). The check fires in _handle_frame after decompress_sync.","commonSituations":"Streaming large JSON/binary blobs over a compressed WS connection, a ZIP-bomb-style payload from a client, or max_msg_size lowered for memory protection while the remote sends a large compressed message.","solutions":["Raise max_msg_size on ws_connect()/WebSocketResponse() to a value that fits your largest expected message.","Reduce message size on the sender side or stream the data in smaller application-level chunks.","Catch WebSocketError with code MESSAGE_TOO_BIG and respond by closing with WSCloseCode.MESSAGE_TOO_BIG.","If untrusted peers are involved, keep a strict limit to prevent a decompression resource-exhaustion (zip-bomb) attack."],"exampleFix":"// before\nws = await session.ws_connect(url)\n// after (allow larger decompressed payloads)\nws = await session.ws_connect(url, max_msg_size=16 * 1024 * 1024)","handlingStrategy":"try-catch","validationCode":"ws = await session.ws_connect(url, max_msg_size=16 * 1024 * 1024)  # size to fit your payloads","typeGuard":null,"tryCatchPattern":"from aiohttp import WSCloseCode, WebSocketError\ntry:\n    async for msg in ws:\n        ...\nexcept WebSocketError as exc:\n    if exc.code == WSCloseCode.MESSAGE_TOO_BIG:\n        await ws.close(code=WSCloseCode.MESSAGE_TOO_BIG)","preventionTips":["Set max_msg_size to the largest legitimate decompressed message you expect.","Stream large data in smaller application-level messages instead of one big frame.","Keep a strict limit for untrusted peers to avoid decompression bombs."],"tags":["websocket","message-too-big","compression","permessage-deflate","dos"],"analyzedSha":"d9aaf697c2cd4783ca5749a971965c689f3ec24f","analyzedAt":"2026-08-06T21:30:48.638Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}