CVE-2026-62389
Published Jul 15, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Jul 29, 2026 6:30 PM
Title updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS | |
| Metrics |
ssvc
|
Jul 29, 2026 5:45 PM
Description updated. Weaknesses updated. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. |
| Weaknesses | CWE-770 | |
| CPEs | ||
| Vendors & Products |
Websockets Project
Websockets Project websockets |
|
| References |
|
|
| Metrics |
cvssV3_1
|
Jul 28, 2026 2:30 AM
First appearance in the feed. Affected versions updated. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Websockets Project
Websockets Project websockets |
|
| CPEs | cpe:2.3:a:websockets_project:websockets:*:*:*:*:*:python:*:* | |
| Vendors & Products |
Websockets Project
Websockets Project websockets |
Jul 16, 2026 12:00 AM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Websockets
Websockets ws |
|
| Vendors & Products |
Websockets
Websockets ws |
Jul 15, 2026 6:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Jul 15, 2026 5:30 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion. | |
| Title | ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
Weaknesses
No weakness.
