CVE-2026-103472
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
Risk Assessment
An attacker can cause a server crash, leading to service unavailability for users.
Recommendation
Update restbed to a version newer than 5.0.0 that contains the security fix.
Other vulnerabilities in restbed
Original NVD description (English source)
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS