What’s Vulnerable › Vulnerabilities

CVE-2026-103472: restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-01
• Weakness: CWE-770

Description

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.

Affected products

• Corvusoft restbed: through 5.0.0

References

• https://github.com/Corvusoft/restbed
• https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/web_socket_impl.cpp#L117
• https://github.com/Corvusoft/restbed/issues/558
• https://www.vulncheck.com/advisories/restbed-through-5.0.0-websocket-memory-exhaustion-via-unbounded-frame-buffering

Get alerted when CVE-2026-103472 or the next vulnerability affects your stack