CVE-2026-103472

Name of the Vulnerable Software and Affected Versions restbed versions prior to 5.0.1

Description The software accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. This allows remote unauthenticated attackers to declare large frame sizes and stream payload data to exhaust server memory, resulting in a denial of service through a process crash.

Recommendations Update to a version newer than 5.0.0.