Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck
CVE-2026-103472restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering
High 7.5
In plain English
A high-severity resource allocation without limits in restbed from Corvusoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 61.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #558 issue-tracking
- https://github.com/Corvusoft/restbed product
- https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/web_socket_impl.cpp#L117 technical-description
- VulnCheck Advisory: restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering third-party-advisory