Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2026-28412Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in textream from f. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
f	textream	< 1.5.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/f/textream/security/advisories/GHSA-qr5p-7x47-qxh9 x_refsource_CONFIRM
https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1 x_refsource_MISC