[ CVE-2026-103472 · Published 30 Sep 2026 ]
Vulnerability in Corvusoft restbed
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.