CVE-2026-103472: restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using restbed through version 5.0.0 that accept WebSocket connections are exposed. The issue is reachable remotely over the network and does not require authentication or user interaction.
What must an attacker do to trigger the memory exhaustion?
An attacker needs to send WebSocket frames declaring very large payload lengths, potentially up to 2^63 bytes, and stream payload data. The server buffers this data without a size limit, which can exhaust memory and crash the process.
Is a special configuration required for exploitation?
No special configuration requirement is described. Exposure depends on the application accepting WebSocket frames through the affected restbed implementation.