CVE-2025-51846

High

Published: 30/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CryptPad version 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance.

Risk Assessment

An attacker can cause serious disruptions to the service, affecting availability for all users.

Recommendation

It is recommended to upgrade to version 2026.2.2 to mitigate this vulnerability.

Other vulnerabilities in CryptPad

CVE-2026-26028Medium
CryptPad before 2026.2.0 has an HTML sanitizer bypass in Diffmarked.js. The sanitizer only validates the src attribute of <iframe>, <video>, and <audio> elements, leaving other attributes like srcdoc unchecked. An attacker can inject arbitrary HTML, defeating bounce sandboxing.

Original NVD description (English source)

CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.