Vulnerability · Published May 29, 2026 · Assigned by VulnCheck

CVE-2026-10099XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py

Medium 4.0

In plain English

A medium-severity security flaw in XX-Net from XX-net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.1%top 97.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.

Affected products (as reported)

Vendor	Product	Versions
XX-net	XX-Net	0 – through 5.16.60 – through 43aec6f

Weakness: CWE-1286 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/XX-net/XX-Net/issues/14169 issue-tracking
https://github.com/XX-net/XX-Net/pull/14170 issue-tracking
https://github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53 patch
https://www.vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py third-party-advisory