CVE-2026-103472
highrestbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded strea…
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-30 18:18
Modified: 2026-10-01 19:17
NVD status: Deferred
Last synced 2 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Corvusoft/restbed disclosure@vulncheck.com
- https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/cor... disclosure@vulncheck.com
- https://github.com/Corvusoft/restbed/issues/558 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/restbed-through-5.0.0-websocket-memory-exhaustion-via... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗