Corvusoft CVEs and Security Vulnerabilities

CVE-2026-103472

restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Corvusoft

Products

Restbed

CVE-2026-103471

restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.