{"id":"322bf17f6f7fb538","repo":"aio-libs/aiohttp","slug":"1009-322bf1","errorCode":"1009","errorMessage":"Decompressed message exceeds size limit {max_msg_size}","messagePattern":"Decompressed message exceeds size limit (.+?)","errorType":"exception","errorClass":"WebSocketError","httpStatus":null,"severity":"error","filePath":"aiohttp/_websocket/reader_py.py","lineNumber":257,"sourceCode":"            # received.\n            if compressed:\n                if not self._decompressobj:\n                    self._decompressobj = ZLibDecompressor(suppress_deflate_header=True)\n                # XXX: It's possible that the zlib backend (isal is known to\n                # do this, maybe others too?) will return max_length bytes,\n                # but internally buffer more data such that the payload is\n                # >max_length, so we return one extra byte and if we're able\n                # to do that, then the message is too big.\n                payload_merged = self._decompressobj.decompress_sync(\n                    assembled_payload + WS_DEFLATE_TRAILING,\n                    (\n                        self._max_msg_size + 1\n                        if self._max_msg_size\n                        else self._max_msg_size\n                    ),\n                )\n                if self._max_msg_size and len(payload_merged) > self._max_msg_size:\n                    raise WebSocketError(\n                        WSCloseCode.MESSAGE_TOO_BIG,\n                        f\"Decompressed message exceeds size limit {self._max_msg_size}\",\n                    )\n            elif type(assembled_payload) is bytes:\n                payload_merged = assembled_payload\n            else:\n                payload_merged = bytes(assembled_payload)\n\n            size = len(payload_merged)\n            if opcode == OP_CODE_TEXT:\n                if self._decode_text:\n                    try:\n                        text = payload_merged.decode(\"utf-8\")\n                    except UnicodeDecodeError as exc:\n                        raise WebSocketError(\n                            WSCloseCode.INVALID_TEXT, \"Invalid UTF-8 text message\"\n                        ) from exc\n","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/_websocket/reader_py.py#L239-L275","documentation":"Raised after inflating a compressed (permessage-deflate) WebSocket message when the decompressed byte count exceeds the negotiated _max_msg_size. This is aiohttp's defence against compression-amplification (zip-bomb) attacks; the connection is closed with code 1009 (MESSAGE_TOO_BIG). The reader deliberately decompresses max_msg_size+1 bytes so it can detect overshoot exactly.","triggerScenarios":"A peer sends a TEXT/BINARY frame with RSV1 set (compress) whose decompressed payload is larger than max_msg_size (default 4 MiB), surfaced in _handle_frame at reader_py.py:257.","commonSituations":"Peers sending large JSON/log blobs over compressed websockets, malicious payloads, or a too-small max_msg_size set on WebSocketResponse / ws_connect while the server legitimately needs to send big compressed documents.","solutions":["Raise max_msg_size on WebSocketResponse(...)/ws_connect(...) if larger compressed messages are legitimate.","Have the peer stream the data in smaller complete (non-fragmented or per-message) frames.","If unexpected, investigate the peer: a small compressed frame blowing past the limit indicates a zip-bomb attempt."],"exampleFix":"# before\nws = WebSocketResponse()  # default max_msg_size = 4 MiB\n\n# after\nws = WebSocketResponse(max_msg_size=16 * 1024 * 1024)  # 16 MiB","handlingStrategy":"validation","validationCode":"max_msg_size = 16 * 1024 * 1024  # size to fit largest legit compressed message\nws = WebSocketResponse(max_msg_size=max_msg_size)","typeGuard":null,"tryCatchPattern":"msg = await ws.receive()\nif msg.type == aiohttp.WSMsgType.ERROR and ws.exception().code == 1009:\n    # message too big; log and close\n    await ws.close()","preventionTips":["Size max_msg_size to the largest legitimate compressed payload","Have peers stream large data in smaller messages"],"tags":["websocket","compression","size-limit","security","rfc7692"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}